Malicious Package

Overview txs-lib-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview mutex-thread is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview eth-react-provider is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bnpl-blocks-independent-bnpl-search is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview fb-forms-form-boilerplate-contacts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview sugarball-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview test-npm-snurkeburk-hackerone is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview plugin-react-vite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview club-sauce is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @sidp-kiosk/test-npm-snurkeburk-hackerone is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview solidity-hold is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dev-env-check is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview npm-wold is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview syjoy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview ts-rand-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview expect-dotenv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bunnyhijack-test-0x00 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview modsync is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview datetime-toolkit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview colorpicker-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview griffin-transliterator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview hardhat-hold is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview commonweb-moneymovement is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview twapfetch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview luluking1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview postcss-initialize-provider is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview motionspring is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview streak-key-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview chromecast-webdriver-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview raectjs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview mutex-plus is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview eslint-config-consumerweb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through TransportSocketSnapshot in xds/src/main/java/com/linecorp/armeria/xds/TransportSocketSnapshot.java. An attacker can perform a man-in-the-middle attack against an xDS-managed upstream connection by...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the XML catalog parsing process when a nextCatalog element lacks the required catalog attribute. An attacker can cause the application to crash by supplying a specially crafted XML catalog file to an...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...

Reliance on Untrusted Inputs in a Security Decision

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the getTrustProxyFn hop-count handling in lib/request.js when trustProxy is configured as a number. An attacker can overwrite...

Improper Validation of Specified Type of Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the request validation path in lib/validation.js. An attacker can bypass body schema type enforcement by sending a root-level primitiv...

Server-side Request Forgery (SSRF)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the processing of JSON fields from an external API response in the device...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the graphdescr. configuration setting, which is rendered without proper escaping in...

Command Injection

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Command Injection in the AboutController process when the snmpget configuration parameter is manipulated to point to ...

Authorization Bypass Through User-Controlled Key

Overview @neo4j/graphql is an A GraphQL to Cypher query execution layer for Neo4j and JavaScript GraphQL implementations Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the isAuthenticated check in...

Authorization Bypass Through User-Controlled Key

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the upload and revoke. An attacker can cause unauthorized revocation of certificates at the certificate authority by...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the CertificateExport handler when the selected export plugin has requireskey set to False. An attacker can access certificate public data without prop...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the POST /api/1/authorities process when the ADMINONLYAUTHORITYCREATION configuration is set to False. An attacker can gain unauthorized control over...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the replaces. An attacker can suppress certificate expiration notifications and force the deployment of unauthorized certificates to endpoints by...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the destinations API endpoints due to insufficient authorization checks. An attacker can access plaintext credentials, such as SFTP passwords and priva...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the acmeurl option during the authority update. An attacker can cause the backend to make arbitrary HTTP requests to internal or external...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via HTTP redirect following and DNS rebinding in the validaterevocationurl function. An authenticated attacker can supply a revocation URL CRL ...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ACME client following server-controlled URLs in acmehandlers.py. A malicious or compromised ACME server can embed arbitrary internal UR...