Malicious Package

Overview illusion-datalab is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview kartykgithub-ph-e is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview online-header is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview danz-bails is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview homestack-cheer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview rubbydev-crash-baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview wailib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview okra-cloud-cdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @bluewin/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview prastzy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview luoxy-baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ai-workshop-maa15-radio is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview alexa-cybertron-team-code-review-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview gocommunity.io/orderedbtree is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview gogets.dev/btreex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded PBKDF2 parameters in the PBMAC1 key-derivation path in JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator. An attacker can force excessive PBKDF2 wo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded PBKDF2 parameters in the PBMAC1 key-derivation path in JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator. An attacker can force excessive PBKDF2 wo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded PBKDF2 parameters in the PBMAC1 key-derivation path in JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator. An attacker can force excessive PBKDF2 wo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded PBKDF2 parameters in the PBMAC1 key-derivation path in JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator. An attacker can force excessive PBKDF2 wo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded PBKDF2 parameters in the PBMAC1 key-derivation path in JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator. An attacker can force excessive PBKDF2 wo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded PBKDF2 parameters in the PBMAC1 key-derivation path in JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator. An attacker can force excessive PBKDF2 wo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded PBKDF2 parameters in the PBMAC1 key-derivation path in JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator. An attacker can force excessive PBKDF2 wo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded PBKDF2 parameters in the PBMAC1 key-derivation path in JcePBMac1CalculatorBuilder and PKCS12PBEUtils.createPBMac1Calculator. An attacker can force excessive PBKDF2 wo...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring t...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring t...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring t...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring t...

Timing Attack

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and...

Timing Attack

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling...

Improper Handling of Length Parameter Inconsistency

Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency in the handling of length parameters in the Lua bindings. An attacker can cause excessive resource allocation by sending requests with inconsistent length parameters, potentially...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value through CcmParameters and CcmBlockCipher in the CMS ASN.1 parameter parsing and CCM cipher initialization paths. An attacker can modify AES-CCM-encrypted CMS content without detection by...

Missing Cryptographic Step

Overview Affected versions of this package are vulnerable to Missing Cryptographic Step in crypto/src/crypto/modes/KCcmBlockCipher.cs is vulnerable to ciphertext forgery due to missing nonce binding in DSTU 7624 CCM mode. An attacker can forge a valid ciphertext and authentication tag by observin...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PKMacBuilder iteration-count verification in the CMP/CRMF password-based MAC code. An attacker can send a CMP message or CRMF certificate request with a PBMParameter that...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the stream-mode IesEngine processing path in crypto/src/crypto/engines/IesEngine.cs. An attacker can forge shorter ciphertexts that the recipient accepts as authentic by observing one...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation through DHAgreement.CalculateAgreement in crypto/src/crypto/agreement/DHAgreement.cs. An attacker can make the local party compute a shared value the attacker already knows, or expose the static private key...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure through IesEngine.DecryptBlock in crypto/src/crypto/engines/IesEngine.cs. An attacker can recover plaintext from captured IES or ECIES ciphertexts by submitting modified ciphertexts for decryption under the same key...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to unbounded DTLS handshake reassembly in DtlsReliableHandshake and DtlsReassembler. A remote unauthenticated DTLS peer can exhaust memory by sending crafted handshake fragments with a lar...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the PkixNameConstraintValidator process. An attacker can bypass name constraints by crafting certificates with an rfc822Name, dNSName, or uniformResourceIdentifier whose host ends with a trailing dot,...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the HSS public key and signature parsing in HssPublicKeyParameters and HssSignature. An attacker can exhaust memory by supplying a malicious HSS public key with an excessive level count an...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in IetfUtilities.ValueToString and X509Name.ToString in the X.509 distinguished name string conversion code. An attacker can exhaust CPU by supplying a certificate, CRL, certification request, or other...

Signed to Unsigned Conversion Error

Overview Affected versions of this package are vulnerable to Signed to Unsigned Conversion Error due to unsigned leafindex values being compared as signed integers in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove. An attacker can exhaust heap memory and crash the JVM by sending a small...

Signed to Unsigned Conversion Error

Overview Affected versions of this package are vulnerable to Signed to Unsigned Conversion Error due to unsigned leafindex values being compared as signed integers in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove. An attacker can exhaust heap memory and crash the JVM by sending a small...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the ASN.1 parser through the Asn1InputStream and Asn1StreamParser nested constructed-element parsing paths. An attacker can trigger a denial of service by supplying a crafted ASN.1 encoding with deeply nested...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via the ProcessPacket decryption paths in CcmBlockCipher and KCcmBlockCipher. An attacker can recover decrypted ciphertext bytes by sending a forged CCM/KCCM message to an application that...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through SignatureSubpacketsReader.ReadPacket and UserAttributeSubpacketsReader.ReadPacket in the OpenPGP subpacket parsers. An attacker can trigger denial of service by supplying a crafted...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop through the GenerateDerivedKey loop in Pkcs12ParametersGenerator in crypto/src/crypto/generators/Pkcs12ParametersGenerator.cs. An attacker can exhaust CPU by supplying a PKCS12 PFX file or PKCS8 encrypted private key with ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded PKCS12 iteration counts in Pkcs12Store.VerifyPbeMac and Pkcs12Utilities.ConvertToDefiniteLength. An attacker can exhaust CPU by supplying a crafted PKCS12/PFX file wi...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through PkixNameConstraintValidator.ExtractHostFromURL in crypto/src/pkix/PkixNameConstraintValidator.cs. An attacker can bypass URI name constraints during certification path validation by supplying a...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the WithinDNSubtree method in PkixNameConstraintValidator.cs. An attacker who controls, or can obtain certificates from, a name-constrained intermediate CA can have a certificate accepted by PKIX path...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in Pkcs12Store.GetCertificateChain in crypto/src/pkcs/Pkcs12Store.cs. An attacker can force the call to never return and exhaust CPU and memory by supplying a crafted PKCS12 file with issuer links that form a cycle, such a...