org.webjars.npm:chai-enzyme (0.6.1), org.webjars.npm:hashish (0.0.4) +5 more potentially affected by CVE-2026-107353 via org.webjars.npm:traverse (0.6.7)

org.webjars.npm:traverse MAVEN version 0.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:traverse and may be impacted: - org.webjars.npm:chai-enzyme 0.6.1 - org.webjars.npm:hashish 0.0.4 - org.webjars.npm:json-to-json-transformer...

Malware in transform-json-strings

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in transform-json-strings (npm)

The package 'transform-json-strings' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1569 Malicious code in transform-json-strings (npm)

The package 'transform-json-strings' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

EUVD-2025-121163

Malicious code in transform-json-react-bootstrap-telesto npm...

org.apache.nifi:nifi-kafka-connector-tests (>=1.14.0, <=1.23.2), org.apache.nifi:nifi-standard-nar (>=1.14.0, <=1.15.3) +4 more potentially affected by CVE-2023-49145 via org.apache.nifi:nifi-jolt-transform-json-ui (>=1.14.0, <=1.23.2)

org.apache.nifi:nifi-jolt-transform-json-ui MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.15.0, =1.14.0, =1.23.2 - org.apache.plc4x:plc4j-nifi-plc4x-nar 0.10.0 - org.apache.plc4x:plc4j-nifi-plc4x-processors 0.10.0 Source cves: CVE-2023-49145 Source advisory: GHSA-68PR-6FJC-WMGM...

org.apache.nifi:nifi-kafka-connector-tests (>=1.14.0, <=1.23.2), org.apache.nifi:nifi-standard-nar (>=1.14.0, <=1.15.3) +4 more potentially affected by CVE-2023-49145 via org.apache.nifi:nifi-jolt-transform-json-ui (>=1.14.0, <=1.23.2)

org.apache.nifi:nifi-jolt-transform-json-ui MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.15.0, =1.14.0, =1.23.2 - org.apache.plc4x:plc4j-nifi-plc4x-nar 0.10.0 - org.apache.plc4x:plc4j-nifi-plc4x-processors 0.10.0 Source cves: CVE-2023-49145 Source advisory: OSV:GHSA-68PR-6FJC-WMGM...

org.apache.nifi:nifi-kafka-connector-tests (>=1.14.0, <=1.23.2), org.apache.nifi:nifi-standard-nar (>=1.14.0, <=1.15.3) +4 more potentially affected by CVE-2023-49145 via org.apache.nifi:nifi-jolt-transform-json-ui (>=1.14.0, <=1.23.2)

org.apache.nifi:nifi-jolt-transform-json-ui MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.15.0, =1.14.0, =1.23.2 - org.apache.plc4x:plc4j-nifi-plc4x-nar 0.10.0 - org.apache.plc4x:plc4j-nifi-plc4x-processors 0.10.0 Source cves: CVE-2023-49145 Source advisory: MEND:CVE-2023-49145...

Apache NiFi cross-site scripting vulnerabilities

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. Apache NiFi suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and...