Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Critical —
Malicious Package in evil-package
All versions of `evil-package` contain malicious code. The package uploads the contents of `process.env` to `example.com/log`. ## Recommendation Remove the package from your environment. Given the host where the information was uploaded to there is no further…
-
Medium —
Unintended Require in larvitbase-www
All versions of `larvitbase-www` are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is ru…
-
Medium —
Path Traversal in public
All versions of `public` are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL. ## Recommendation No fix is currently available. Do not use `public` in product…
-
Medium —
Denial of Service in sequelize
Versions of `sequelize` prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a `TypeError` exception for the `results` variable. The `results` value may be undefined and trigger the error on a `.map` call. This may allo…
-
Critical 9.8
Malicious Package in sparkies
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in serilize
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in serializes
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in node-spdy
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in node-ftp
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mysql-koa
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogoose
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogodb-core
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogodb
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogobd
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in koa-body-parse
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in k0a_multer
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in js-regular
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in js-base64-int
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in import-mysql
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in file-logging
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in bs85
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bs58chekc
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bsae-x
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in body-parse-xml
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in cionstring
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstirng
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinpayment
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstrng
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstrig
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in colne
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in axioss
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in commandre
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in commanedr
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in conistring
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in crpyto-js
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in axios-http
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in crytpo-js
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical —
Command Injection in marsdb
All versions of `marsdb` are vulnerable to Command Injection. In the `DocumentMatcher` class, selectors on `$where` clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is ex…
-
Low —
Authorization Bypass in graphql-shield
Versions of `graphql-shield` prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option `no_cache` relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers t…
-
Critical 9.8
Malicious Package in bb-builder
All versions of `bb-builder` contained malicious code. The package ran an executable targeting Windows and uploaded information to a remote server. ## Recommendation Any computer that has this package installed or running should be considered fully compromise…