Improper Certificate Validation

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation via the Agent constructor in lib/dispatcher/agent.js, where TLS options passed as the tls parameter are silently dropped and never stored ...

Origin Validation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in CacheHandler.onResponseStart, where a redirect to a different origin can cause the final response to be stor...

Improper Handling of Case Sensitivity

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch implementation's Subresource Integrity SRI verification logic, which matches the algorithm token against a...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception via unhandled ERRTLSCERTALTNAMEINVALID errors in onHttpSocketError, onHttp2SessionError, and onHttp2SocketError. When a TLS connection is established a...

Allocation of Resources Without Limits or Throttling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. A remote attacker can send a flood o...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception via the DecompressHandler in lib/interceptor/decompress.js, where an uncaught exception thrown by a downstream handler during onResponseData or...

Allocation of Resources Without Limits or Throttling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the EventSourceStream transform in lib/web/eventsource/eventsource-stream.js, where the maxEventSize limit is onl...

Malicious Package

Overview proxy-rubikis is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview py-wormgpt is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview proxyrobika is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview getpubip is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview marocolor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview proxyrubika is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview fromthehotel-poems is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @flexmr/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @beloved-lenora/opencode-shell-guard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview itsa-react-maskedinput is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview itsa-react-focuscontainer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @beloved-lenora/opencode-orchestrator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview @flexmr/survey-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @xatancchii/natabaileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @flexmr/survey-conversation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview parxleys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @beloved-lenora/opencode-goal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @beloved-lenora/opencode-shared-rpc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview @beloved-lenora/opencode-btw is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @beloved-lenora/opencode-stats is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview @beloved-lenora/opencode-todo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview buyerdashboard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview web-pixels-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview asistenyorstore is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview idlive-face-capture-web-development is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview xapi-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview xmd-baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview @developmentyora/yorakids is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Allocation of Resources Without Limits or Throttling

Overview io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocket extension setup of HttpServerConnectionHandler and Http1ClientConnection, which...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the experimental WebSocket client, where a response failing handshake validation triggers an abort that is a no-op because the request is already...

Improper Protection of Alternate Path

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Improper Protection of Alternate Path via the find function in lib/util/host-rules.ts, where administrator-configured HTTP headers such as authentication credentials for one host can be sent to a...

Brute Force

Overview @better-auth/drizzle-adapter is a Drizzle adapter for Better Auth Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED isolation, the WHE...

Brute Force

Overview @better-auth/kysely-adapter is a Kysely adapter for Better Auth Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED isolation, the WHERE...

Brute Force

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED...

Insufficient Control Flow Management

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Insufficient Control Flow Management via the branch processing logic in lib/workers/repository/update/branch/index.ts, when a rebase is requested on an open pull request that has pending updates, the...

Improper Authentication

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authentication via cross-purpose reuse of verification records, where a token issued for one authentication flow such as OAuth state or OAuth proxy...

Improper Authorization

Overview @better-auth/sso is a SSO plugin for Better Auth Affected versions of this package are vulnerable to Improper Authorization via the deleteSSOProvider route handler, which previously did not receive the options context required to enforce provider lifecycle guards. An authenticated attack...

Server-side Request Forgery (SSRF)

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via outbound HTTP requests in lib/util/http/host-guard.ts and the broader HTTP layer, where an attacker-controlled configuration value such as a customDatasources URL or...

Incorrect Authorization

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Incorrect Authorization via the env configuration option, which is not re-validated against the allowedEnv allowlist when applied from repository config or presets. An authenticated user can set arbitra...

Improper Authentication

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authentication via insufficient isolation between verification record types, allowing an attacker to substitute a token issued for one authenticatio...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the parseHeaders method of MessageParser in src/dkim/message-parser.ts, whose unfold loop appends each...

Inefficient Algorithmic Complexity

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the parseHeaders method of MessageParser in src/dkim/message-parser.ts, whose unfold loop appends each continuation line...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the AUTH mechanism detection of SMTPConnection.actionEHLO in src/smtp-connection/index.ts, where a...