Malicious code in verdaccio-tarball-local-storage (npm)

npm/verdaccio-tarball-local-storage is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11991 Malicious code in verdaccio-tarball-local-storage (npm)

npm/verdaccio-tarball-local-storage is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in verdaccio-okta-oauth (npm)

npm/verdaccio-okta-oauth is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

MAL-2026-11990 Malicious code in verdaccio-okta-oauth (npm)

npm/verdaccio-okta-oauth is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

Malicious code in cursed-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b6aab954f9b8edbc759c97eabe39d7a070c4dbe852586422761ad0f8c7ad95 [email protected] executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded...

MAL-2026-6698 Malicious code in cursed-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b6aab954f9b8edbc759c97eabe39d7a070c4dbe852586422761ad0f8c7ad95 [email protected] executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded...

EUVD-2019-0457

Malware in sbrugna...

Malicious code in melkikh-verdaccio-dc (npm)

The package melkikh-verdaccio-dc was found to contain malicious code...

MAL-2025-26170 Malicious code in melkikh-verdaccio-dc (npm)

The package melkikh-verdaccio-dc was found to contain malicious code...

CVE-2019-14772

verdaccio before 3.12.0 allows XSS...

Cross-site Scripting (XSS)

verdaccio is vulnerable to cross-site scripting XSS. The vulnerability exists as values like props.readMe were not sanitized...

verdaccio cross-site scripting vulnerability

verdaccio is a lightweight private npm registry. A cross-site scripting vulnerability exists in versions prior to verdaccio 3.12.0, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...

CVE-2019-14772

verdaccio before 3.12.0 allows XSS...

Cross site scripting

verdaccio before 3.12.0 allows XSS...

CVE-2019-14772

Verdaccio (npm private registry) before version 3.12.0 is vulnerable to Cross-Site Scripting (XSS) due to insufficient validation of client-side data by the web application. The issue affects Verdaccio instances running 3.12.0 or migrating to major version >=4.0.0 to fix the vulnerability. No ...

CVE-2019-14772

verdaccio before 3.12.0 allows XSS...

verdaccio-gitlab (>=2.0.0, <=2.2.0) potentially affected by CVE-2019-14772 via verdaccio (>=3.6.0, <=3.8.6)

verdaccio NPM version =3.6.0, =2.0.0, =2.2.0 Source cves: CVE-2019-14772 Source advisory: OSV:GHSA-78J5-GCMF-VQC8...

Cross-Site Scripting

Overview Versions of verdaccio prior to 3.12.0 are vulnerable to Cross-Site Scripting. Links for the packages homepage are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Recommendation Upgrade to version 3.12.0 or later. References...

Cross-Site Scripting

Overview Versions of verdaccio prior to 3.12.0 are vulnerable to Cross-Site Scripting. Contents of READMEs are not properly sanitized before rendering, which may allow attackers to execute arbitrary JavaScript code. Recommendation Upgrade to version 3.12.0 or later...