Malicious Package

Overview appit-cordova-plugin-ionic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview sound-cloud-loader-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview ionic-sound-cloud-loader-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview ionic-youtube-streams is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ionic-insta-api-wrapper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview appit-cordova-admob is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview cert-infos is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview insta-reel-search is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview p12-pem is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview ionic-youtube-search is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tiktok-video-scraper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview youtube-info-streams is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview redis-dumper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ocsp-hashes is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview cordova-plugin-geofence-appit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview insta-api-wrapper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ionic-tiktok-scraper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ionic-insta-search is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview youtube-search-without-api-key is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview @eforms/forms-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tailwind-base-buttons is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tailwindcss-theme-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview noelc-css-blender is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Origin Validation Error

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Origin Validation Error via DNSDatagramProtocol.datagramReceived in src/twisted/names/dns.py, where DNS responses are accepted solely on the basis o...

Use of Incorrectly-Resolved Name or Reference

Overview langgraph-checkpoint-sqlite is a Library with a SQLite implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the groupops function in the Postgres and SQLite store backends, due to namespaces...

Use of Incorrectly-Resolved Name or Reference

Overview langgraph-checkpoint-postgres is a Library with a Postgres implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the groupops function in the Postgres and SQLite store backends, due to namespace...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsa...

Insertion of Sensitive Information into Log File

Overview langgraph-cli is a CLI for interacting with LangGraph API Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the --image-uri flag in langgraph deploy, where the CLI pushes a built Docker image to a caller-supplied registry URI using...

Arbitrary Code Injection

Overview org.webjars.npm:happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Arbitrary Code Injection via the ESM compiler...

Arbitrary Code Injection

Overview happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Arbitrary Code Injection via the ESM compiler...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via SQLite side-file handling in readwrite.py on Windows, where a local attacker can plant adversarial -wal or -journal side files adjacent to the lock database in a shared directory such ...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking via SoftFileLock.acquire on Windows, where a os.open call used to read a soft-lock marker file blocks indefinitely when another handle holds a Level 1 or batch oplock on that file and never acknowledges the break reques...

Origin Validation Error

Overview @azure/msal-node is a Microsoft Authentication Library for Node Affected versions of this package are vulnerable to Origin Validation Error via the acquireTokenByCode method in ConfidentialClientApplication, which fails to sanitize the caller-supplied authCodePayload before use. An...

Cross-site Scripting (XSS)

Overview org.webjars.npm:serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via escapeFunctionBody in index.js, which escapes each function bo...

Cross-site Scripting (XSS)

Overview serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via escapeFunctionBody in index.js, which escapes each function body in isolation...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC 5322 §3.2.2...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts, where the tokenizer tracks only a single open operator and does no...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts, where the tokenizer tracks only a single open operator and does not account for...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser src/addressparser/index.ts when processing angle-addr and group constructs. The tokenizer tracks...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser src/addressparser/index.ts when processing angle-addr and group constructs. The tokenizer tracks only a single op...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via fixnamespacepackages in setuptools/wheel.py during legacy wheel installation. Entries in a wheel's namespacepackages.txt are split on . and passed directly to os.path.join, which interprets its arguments as...

Insufficiently Protected Credentials

Overview fastmcp-slim is a The dependency-slim FastMCP package. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via ClientCredentialsOAuthProvider when no issuer is configured, because the client does not validate that the authorization server advertised b...

Insufficiently Protected Credentials

Overview fastmcp is a The fast, Pythonic way to build MCP servers and clients. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via ClientCredentialsOAuthProvider when no issuer is configured, because the client does not validate that the authorization serv...

Denial of Service (DoS)

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Denial of Service DoS via repeated full file loads triggered by malformed PDF input. When getobject in pypdf/reader.py encounters ...

Denial of Service (DoS)

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Denial of Service DoS via repeated full file reads triggered by malformed PDF input. When getobject in pypdf/reader.py encounters ...

Excessive Iteration

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Excessive Iteration via readstandardxreftable in pypdf/reader.py, where a PDF file containing a cross-reference xref table with a...

Improper Check for Certificate Revocation

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an...

Improper Check for Certificate Revocation

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, whic...

Missing Release of Resource after Effective Lifetime

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the Proxy middleware. An attacker can exhaust system resources by repeatedly establishing WebSocket...