Malicious Package

Overview @cw-ui/asio-neon-themes is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @cw-ui/micro-ui-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview micro-ui-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview unified-ui-components-library is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview dom-weave is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview avatar-forge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview duration-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview relative-time-live is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview string-morph is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview clipboard-drop is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview sync-logger is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview temp-cloak is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview valid-scope is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview sight-bind is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview humanize-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview class-synth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview @codex2005/logger-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview class-weaver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @emcd-vue/loans is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @emcd-vue/b2b-pay-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @emcd-vue/auth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the bytePlusDownloadVideo function. An attacker can access internal resources or perform unauthorized requests by supplying crafted values to the output.videourl argument. Remediation There is no fix...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the writeFile function in the ACP ToolBridge Workspace Handler. An attacker can access or modify files outside the intended directory by supplying crafted path input remotely. Details A Directory Traversal attack...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the writeFile function in the ACP ToolBridge Workspace Handler. An attacker can access or modify files outside the intended directory by supplying crafted path input remotely. Details A Directory Traversal attack...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the handleNavigate function of the file pkg/browser/tool.go when manipulating the args.targetUrl argument. An attacker can access sensitive information by sending crafted requests remotely. Remediation There is n...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the handleNavigate function of the file pkg/browser/tool.go when manipulating the args.targetUrl argument. An attacker can access sensitive information by sending crafted requests remotely. Remediation There is n...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the handleNavigate function of the file pkg/browser/tool.go when manipulating the args.targetUrl argument. An attacker can access sensitive information by sending crafted requests remotely. Remediation There is n...

Malicious Package

Overview @amedit/vercel-builder-probe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @sflyinc-knapsack/shutterfly-react is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview kraken-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @flcik/flick.js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview flick-test-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the webfetch function in the IPv4 Handler component when processing the url argument. An attacker can access internal resources, exfiltrate sensitive data, or perform unauthorized actions by supplyin...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the webfetch function in the IPv4 Handler component when processing the url argument. An attacker can access internal resources, exfiltrate sensitive data, or perform unauthorized actions by supplyin...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the guardExecCommand function. An attacker can bypass intended security restrictions by exploiting the failure of the protection mechanism remotely. Remediation There is no fixed version for...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in the editfile process of fsops.go in File Tools. An attacker can access or modify unintended files by exploiting symbolic link following. Remediation There is no fixed version for github.com/mosaxiv/clawlet/config...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in the editfile process of fsops.go in File Tools. An attacker can access or modify unintended files by exploiting symbolic link following. Remediation There is no fixed version for github.com/mosaxiv/clawlet/tools...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the tools.webFetch function. An attacker can make unauthorized requests to internal or external resources by supplying crafted input to the affected process. Remediation There is no fixed version for...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the tools.webFetch function. An attacker can make unauthorized requests to internal or external resources by supplying crafted input to the affected process. Remediation There is no fixed version for...

Malicious Package

Overview @logdna-web/shared is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @flex-ng/filter-pipe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @idms-corp/auth-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @flex-ng/error-component is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview salesforce-vscode-slds is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @flex-ng/header-component is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @logdna-web/styles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tme-error is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview enbd-react-error-boundry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview enbd-react-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview sams-sr-sdk-h5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...