Malicious Package

Overview sysdo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview dxrs-dos is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @lilsccott6x9/devpipe-connector is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview txs-lib-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview @sarex-team/translator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Denial of Service (DoS)

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Denial of Service DoS. Go Vulnerability Report:When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain th...

Uncaught Exception

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Uncaught Exception via the comment formatting. An attacker can cause affected cases to become inaccessible to all users by...

Uncontrolled Recursion

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Uncontrolled Recursion via the custom analysis definition. An attacker can exhaust the thread stack and terminate the affected nod...

Malicious Package

Overview @petitcode/eb-retry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the connections/test API endpoint due to improper enforcement of team-scoped access controls. An attacker can access another team's environment connection and authenticate outward usin...

Malicious Package

Overview @years17/n8n-nodes-utils-helper-i is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @years19/n8n-nodes-utils-helper-o is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @years19/n8n-nodes-utils-helper-y is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @years17/n8n-nodes-helper-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview @years19/n8n-nodes-utils-helper-p is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @years19/n8n-nodes-utils-helper-u is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @years18/n8n-nodes-utils-helper-n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the process. An attacker can execute arbitrary code with high confidentiality, integrity, and availability impact by triggering an out-of-bounds write through crafted input during local execution with required us...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via inconsistent handling of HTTP requests in the System.Net.HttpListener. An attacker can gain unauthorized access to sensitive information by sending specially crafted HTTP requests that exploit discrepancies in...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure through the Chrome DevTools workspace endpoint in packages/nitro-server/src/index.ts. An attacker can retrieve the project’s absolute filesystem root and...

Malicious Package

Overview dlmm-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview pytablute is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in worktreefs.go and worktree.go are vulnerable to symlink traversal in filesystem-backed worktrees. An attacker can modify or overwrite files outside the intended worktree by placing a symlink in the tree and then...

Malicious Package

Overview kepler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the as prop in server island components that forward attacker-controlled values into dynamic...

Improper Validation of Specified Quantity in Input

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the v-for in server-side rendering of islands or server components. An attacker can cause the server to allocate excessive...

Malicious Package

Overview @zzzgenesis00/bip39-generator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits. Remediation A fix was...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Cross-site Scripting (XSS)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Cross-site Scripting XSS in the bundled domino DOM serializer, which does not escape text nodes inside the fallback raw-content elements , , , and during SSR...

Malicious Package

Overview test-dev-sync is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview sap-mcp-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview walmart-genai-trace is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the GOOSE payload parser. An attacker can cause the subscriber process to terminate by sending a specially crafted unauthenticated Layer 2 multicast frame with an attacker-controlled inner element length that...

Malicious Package

Overview express-sequelize-wrapper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview maalxios is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview ncc-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the HTTPS Agent. An attacker can impersonate a client by exploiting PFX object-array key collisions, which may result in mutual TLS client identities being reused across requests configured...

Information Exposure

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Information Exposure via the cache-control parser in lib/util/cache.js used by interceptors.cache. An attacker can cause a private response to be stored in the shared...

Cross-site Scripting (XSS)

Overview mathlive is an A web component for math input Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Box.toMarkup method src/core/box.ts and the MathML serializer src/formats/atom-to-math-ml.ts, which emit literal characters from LaTeX text-mode commands into...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop through the customRandom function in the customRandom implementation. An attacker can hang the calling thread by supplying a size of 0 to customRandom, which causes its ID generation loop to never reach a terminating...

Malicious Package

Overview sigchain-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview kordyn is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...