Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
1,411 results · Clear filters · Feed
-
Critical —
Sandbox Breakout / Arbitrary Code Execution in safer-eval
All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system. ## R…
-
Critical 9.8
Malicious Package in uglyfi.js
Version 0.17.3 of `uglyfi.js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote s…
-
Critical 9.8
Malicious Package in 8.9.4
Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of `8.9.4` contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server. ## Recommendation Remove the package from your environment. There is no evidenc…
-
Critical 9.8
Malicious Package in ember_cli_babe
Version 6.16.0 of `ember_cli_babe` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a rem…
-
Critical 9.8
Malicious Package in harmlesspackage
Version 0.0.1 of `harmlesspackage` contains malicious code as a postinstall script. The package printed a message to the console and performed a GET request to a remote server. ## Recommendation Remove the package from your environment. There is no evidence o…
-
Critical 9.8
Malicious Package in yeoman-genrator
Version 2.0.2 of `yoeman-generator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a re…
-
Critical 9.8
Malicious Package in require-port
Version 1.0.0 of `require-port` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote…
-
Critical 9.8
Malicious Package in pizza-pasta
Version 1.0.3 of `pizza-pasta` contains malicious code as a install scripts. The package created folders in the system's Desktop and downloaded an image from `imgur.com`. The package also printed the users SSH keys to the console. ## Recommendation Remove the…
-
Critical 9.8
Malicious Package in log-symboles
Version 2.1.0 of `log-symboles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote…
-
Critical —
Malicious Package in json-serializer
Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove th…
-
Critical 9.8
Malicious Package in comander
All versions of `comander` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. ##…
-
Critical 9.8
Malicious Package in bmap
Version 1.0.3 of `bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.0.3 of t…
-
Critical 9.8
Malicious Package in discord.js-user
All versions of `discord.js-user` contain malicious code. The package uploads the user's Discord token to a remote server. ## Recommendation Remove the package from your environment. Ensure any compromised tokens are invalidated.
-
Critical —
Path Traversal in @wturyn/swagger-injector
All versions of `@wturyn/swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths. ## Recommendation No fix is currently avai…
-
Critical —
Path Traversal in swagger-injector
All versions of `swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths. ## Recommendation No fix is currently available. C…
-
Critical —
Malicious Package in evil-package
All versions of `evil-package` contain malicious code. The package uploads the contents of `process.env` to `example.com/log`. ## Recommendation Remove the package from your environment. Given the host where the information was uploaded to there is no further…
-
Critical 9.8
Malicious Package in sparkies
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in serilize
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in serializes
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in node-spdy
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in node-ftp
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mysql-koa
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogoose
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogodb-core
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogodb
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogobd
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in koa-body-parse
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in k0a_multer
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in js-regular
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in js-base64-int
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in import-mysql
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in file-logging
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in bs85
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bs58chekc
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bsae-x
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in body-parse-xml
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in cionstring
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstirng
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinpayment
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstrng
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…