Malicious Package

Overview aanthropic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview 1h1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Origin Validation Error

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Origin Validation Error via the WebSocket upgrade handler in lib/Server.js when a devServer.proxy entr...

Information Exposure

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Information Exposure via the isValidHost method in lib/Server.js, where Host and :authority headers ar...

Malicious Package

Overview log-rotate-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview net-codec-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @conduitops/logview-archive is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview simplewave is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview formatting-subtitles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Function Call With Incorrect Argument Type

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Function Call With Incorrect Argument Type via insufficient validation of TIFF tag values before passing them to TIFFSetField in the libtiff encoder. When saving a TIFF image, tag values...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the Arrow array export functions exportsinglechannelarray and exportfixedpixelarray in src/libImaging/Arrow.c when exporting non-contiguous images. When image rows are not stored contiguously in memory ...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via missing decompression bomb checks in the seek methods of DcxImagePlugin, MicImagePlugin, and MpoImagePlugin. When a...

Allocation of Resources Without Limits or Throttling

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via linearizepagetree in src/PIL/PdfParser.py when parsing a PDF file containing a cyclic or duplicate page tree reference. An attacker ca...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the seek method in src/PIL/SpiderImagePlugin.py, which lacks a decompression bomb check after seeking to a new frame in a SPIDER format image. An attacker can supply a...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the JPEG COM marker encoding path in JpegEncode.c, when a JPEG image carrying an oversized comment in its im.info metadata is re-encoded. The comment length is not validated before being written as a COM marker,...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via the load method in src/PIL/Image.py, where a loop consuming repeated Exif\x00\x00 headers in Exif data has no upper bound on iterations. An attacker can supply image data with an arbitrarily long...

Out-of-bounds Read

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Out-of-bounds Read via the PyImagingDrawWmf function in src/display.c when processing a WMF image with dimensions exceeding 65535. The bcWidth and bcHeight fields in BITMAPCOREHEADER are 16-b...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the textwidth function in src/imaging.c, where accumulating negative glyph advance widths can cause the integer accumulator xsize to wrap below INTMIN. An attacker can trigger this by supplying text...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via TarIO.init in src/PIL/TarIO.py, where a maliciously constructed TAR archive can supply a file entry with a size value that causes the computed block offset to be zero or negative. When iterating over TAR entries to...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in BmpImagePlugin.py via the RLE-compressed BMP decoder, where the decode method appends null bytes to an output buffer without bounding the amount against the expected...

Permissive List of Allowed Inputs

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via xobjtoimage in pypdf/generic/imagexobject.py, which passes /DCTDecode stream data to...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded stream parsing in the PDF content stream parser, which imposes ...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded stream parsing in the PDF content stream parser, which imposes ...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the getfields function in pypdf/doccommon.py, which previously used a lis...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop via cyclic tree structures in TreeObject.removechild and PdfWriter.findoutlineitem, where a PDF containing a...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop via TreeObject.removechild and PdfWriter.findoutlineitem when processing a PDF containing a cyclic outline bookmark...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop via readstandardxreftable in pypdf/reader.py, where processing a malformed PDF file with a truncated cross-reference...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decodestreamdata function in pypdf/filters.py, where a PDF stream...

Malicious Package

Overview test-brotli2-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview pixel-map-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview event-emitter-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @sudobility/wildduckclient is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @sudobility/testomniacclient is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @sudobility/shaperouterclient is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @worrisome/aaaa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview peptide-modify is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview test-brotli-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview data-pipeline-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @sudobility/indexerclient is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview log-sink-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview phonoviatts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview solivoxtts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview libseal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview codecraze is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview shellgrip is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview tessivatts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview melcuratts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview prosodinetts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview audiokit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview hookgantry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...