Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
1,411 results · Clear filters · Feed
-
Critical 9.1
Malicious Package in coinstrig
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in colne
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in axioss
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in commandre
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in commanedr
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in conistring
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in crpyto-js
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in axios-http
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in crytpo-js
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical —
Command Injection in marsdb
All versions of `marsdb` are vulnerable to Command Injection. In the `DocumentMatcher` class, selectors on `$where` clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is ex…
-
Critical 9.8
Malicious Package in bb-builder
All versions of `bb-builder` contained malicious code. The package ran an executable targeting Windows and uploaded information to a remote server. ## Recommendation Any computer that has this package installed or running should be considered fully compromise…
-
Critical —
Malicious Package in device-mqtt
Version 1.0.11 of `device-mqtt` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the pa…
-
Critical —
Malicious Package in slush-fullstack-framework
Version 0.9.2 of `slush-fullstack-framework` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation …
-
Critical —
Malicious Package in pensi-scheduler
Version 1.1.3 of `pensi-scheduler` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the…
-
Critical —
Malicious Package in pyramid-proportion
Version 1.0.5 of `pyramid-proportion` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove …
-
Critical —
Malicious Package in ngx-context-menu
Version 0.0.26 of `ngx-context-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove t…
-
Critical —
Malicious Package in @fangrong/xoc
Version 1.0.6 of `@fangrong/xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the p…
-
Critical —
Malicious Package in iie-viz
Version 1.0.4 of `iie-viz` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the package…
-
Critical —
Malicious Package in jquery-airload
Version 0.2.5 of `jquery-airload` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the …
-
Critical —
Malicious Package in uploader-plugin
Version 1.0.2 of `uploader-plugin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the…
-
Critical 9.8
Malicious Package in zemen
Version 0.0.5 of `zemen` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the package f…
-
Critical —
Malicious Package in sailclothjs
Version 1.2.6 of `sailclothjs` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the pac…
-
Critical 9.8
Malicious Package in cal_rd
Version 0.1.1 of `rc_cal` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the package …
-
Critical —
Path Traversal in f-serv
All versions of `f-serv` are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. ## Recommendation No fix is currently available. Consider using an altern…
-
Critical 9.8
Malicious Package in anarchy
All versions of `anarchy` contain malicious code. The package ran `rm - rf /` as an install script. ## Recommendation Remove the package from your environment.
-
Critical 9.8
Malicious Package in fast-requests
All versions of `fast-requests` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remove the…
-
Critical 9.8
Malicious Package in cage-js
All versions of `cage-js` contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secr…
-
Critical 9.8
Malicious Package in rate-map
Version 1.0.3 of `rate-map` contains malicious code. The malware breaks functionality of the `purescript-installer` package by rewriting code of the `dl-tar` dependency. ## Recommendation Upgrade to version 1.0.5 or later. There is no indication of further co…
-
Critical 9.8
Malicious Package in load-from-cwd-or-npm
Version 3.0.2 of `load-from-cwd-or-npm` contains malicious code. The malware breaks functionality of the `purescript-installer` package by injecting targeted code. ## Recommendation Upgrade to version 3.0.4 or later. There is no indication of further compromi…
-
Critical 9.8
Malicious Package in nodes.js
All versions of `nodes.js ` contain malicious code. The package searches and installs globally thousands of packages based on keywords `node`, `react`, `react-native`, `vue`, `angular` and `babel` to fill the system's memory. ## Recommendation Remove the pack…
-
Critical 9.8
Malicious Package in deasyncp
All versions of `deasyncp ` contain malicious code. The package shuts down the machine upon installation as a preinstall script. ## Recommendation Remove the package from your environment. There is no further compromise.
-
Critical 9.8
Malicious Package in sdfjghlkfjdshlkjdhsfg
All versions of `sdfjghlkfjdshlkjdhsfg` contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version. ## Recommendation Remove the pac…
-
Critical 9.8
Malicious Package in tiar
All versions of `tiar` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All s…
-
Critical 9.8
Malicious Package in secure_identity_login_module
All versions of `secure_identity_login_module` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered …
-
Critical 9.8
Malicious Package in river-mock
All versions of `river-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…
-
Critical 9.8
Malicious Package in retcodelog
All versions of `retcodelog` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…
-
Critical 9.8
Malicious Package in qingting
All versions of `qingting` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. A…
-
Critical 9.8
Malicious Package in node-buc
All versions of `node-buc` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. A…
-
Critical 9.8
Malicious Package in midway-dataproxy
All versions of `midway-dataproxy` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compro…
-
Critical 9.8
Malicious Package in midway-xtpl
All versions of `midway-xtpl` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised…