Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Critical 9.8
Malicious Package in budfer-xor
Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in bufber-xor
Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in bubfer-xor
Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in btffer-xor
Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in bqffer-xor
Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in beffer-xor
Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in b5ffer-xor
Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical —
Cross-Site Scripting in dompurify
Versions of `dompurify` prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser. ## Recommendation U…
-
Medium 6.8
Authentication Bypass in saml2-js
Versions of `saml2-js` prior to 2.0.5 are vulnerable to an Authentication Bypass. The package fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted assertion tokens indefinitely. ## Recommendation U…
-
Medium 5.9
Insecure Cryptography Algorithm in simple-crypto-js
Versions of `simple-crypto-js` prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data. ## Recommendation Upgrade to version 2.3.0 or later.
-
Critical —
Sandbox Breakout / Arbitrary Code Execution in safer-eval
All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system. ## R…
-
High —
Cross-Site Scripting in markdown-to-jsx
Versions of `markdown-to-jsx` prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing `…
-
High 7.5
Unauthorized File Access in node-git-server
Versions of `node-git-server` prior to 0.6.1 are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories. ## Recommendation Upgrade to version 0.6.1 …
-
Low —
Denial of Service in express-fileupload
Versions of `express-fileupload` prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed (up to 30s in internal testing) if the request contains a large `filename` of `.` characters. ## Recommendation Upgr…
-
High —
Cross-Site Scripting in hexo-admin
All versions of `hexo-admin` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a victim's browser if they are able to create new posts. ## Recommendation No fix…
-
High —
Denial of Service in mongodb
Versions of `mongodb` prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application. ## Recommendation Upgrade to version 3.1.13 or l…
-
Critical 9.8
Malicious Package in uglyfi.js
Version 0.17.3 of `uglyfi.js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote s…
-
Critical 9.8
Malicious Package in 8.9.4
Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of `8.9.4` contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server. ## Recommendation Remove the package from your environment. There is no evidenc…
-
Critical 9.8
Malicious Package in ember_cli_babe
Version 6.16.0 of `ember_cli_babe` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a rem…
-
Critical 9.8
Malicious Package in harmlesspackage
Version 0.0.1 of `harmlesspackage` contains malicious code as a postinstall script. The package printed a message to the console and performed a GET request to a remote server. ## Recommendation Remove the package from your environment. There is no evidence o…
-
Critical 9.8
Malicious Package in yeoman-genrator
Version 2.0.2 of `yoeman-generator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a re…
-
Critical 9.8
Malicious Package in require-port
Version 1.0.0 of `require-port` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote…
-
Critical 9.8
Malicious Package in pizza-pasta
Version 1.0.3 of `pizza-pasta` contains malicious code as a install scripts. The package created folders in the system's Desktop and downloaded an image from `imgur.com`. The package also printed the users SSH keys to the console. ## Recommendation Remove the…
-
Critical 9.8
Malicious Package in log-symboles
Version 2.1.0 of `log-symboles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote…
-
Critical —
Malicious Package in json-serializer
Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove th…
-
Critical 9.8
Malicious Package in comander
All versions of `comander` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. ##…
-
Critical 9.8
Malicious Package in bmap
Version 1.0.3 of `bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.0.3 of t…
-
Medium —
Denial of Service in http-live-simulator
Versions of `http-live-simulator` prior to 1.0.8 are vulnerable to Denial of Service. The package fails to catch an exception that causes the Node process to crash, effectively shutting down the server. This allows an attacker to send an HTTP request that cra…
-
Medium 5.0
Sensitive Data Exposure in ibm_db
Versions of `ibm_db` prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode. ## Recommendation Upgrade to version 2.6.0 or later and ensure sensitive information was not logg…
-
Low —
Denial of Service in apostrophe
Versions of `apostrophe` prior to 2.97.1 are vulnerable to Denial of Service. The `apostrophe-jobs` module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to…
-
Critical 9.8
Malicious Package in discord.js-user
All versions of `discord.js-user` contain malicious code. The package uploads the user's Discord token to a remote server. ## Recommendation Remove the package from your environment. Ensure any compromised tokens are invalidated.
-
Medium 6.5
Configuration Override in helmet-csp
Versions of `helmet-csp` before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the `default-src` CSP policy, which is the fallback policy. This …
-
Critical —
Path Traversal in @wturyn/swagger-injector
All versions of `@wturyn/swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths. ## Recommendation No fix is currently avai…
-
Critical —
Path Traversal in swagger-injector
All versions of `swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths. ## Recommendation No fix is currently available. C…
-
Medium 6.5
Cross-Site Scripting in mavon-editor
All versions of `mavon-editor` are vulnerable to Cross-Site Scripting. The package fails to sanitize entered input, allowing attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation No fix is currently available. Consider using an al…
-
High —
Denial of Service in subtext
All versions of `subtext` are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payloa…
-
High —
Cross-Site Scripting in snekserve
All versions of `snekserve` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. ## Recommendation…
-
High —
Denial of Service in @commercial/subtext
Versions of `@commercial/subtext` prior to 5.1.1 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send request…
-
High —
Denial of Service in @hapi/subtext
Versions of `@hapi/subtext` prior to 6.1.2 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with…
-
High —
Regular Expression Denial of Service in sql-injection
All versions of `sql-injection` are vulnerable to Regular Expression Denial of Service. The package processes a request's body with regular expressions that may take exponentially longer to execute for large inputs. ## Recommendation No fix is currently avail…