Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Critical —
Malicious Package in device-mqtt
Version 1.0.11 of `device-mqtt` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the pa…
-
Critical —
Malicious Package in slush-fullstack-framework
Version 0.9.2 of `slush-fullstack-framework` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation …
-
Critical —
Malicious Package in pensi-scheduler
Version 1.1.3 of `pensi-scheduler` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the…
-
Critical —
Malicious Package in pyramid-proportion
Version 1.0.5 of `pyramid-proportion` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove …
-
Critical —
Malicious Package in ngx-context-menu
Version 0.0.26 of `ngx-context-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove t…
-
Critical —
Malicious Package in @fangrong/xoc
Version 1.0.6 of `@fangrong/xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the p…
-
Critical —
Malicious Package in iie-viz
Version 1.0.4 of `iie-viz` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the package…
-
Critical —
Malicious Package in jquery-airload
Version 0.2.5 of `jquery-airload` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the …
-
Critical —
Malicious Package in uploader-plugin
Version 1.0.2 of `uploader-plugin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the…
-
Critical 9.8
Malicious Package in zemen
Version 0.0.5 of `zemen` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the package f…
-
Critical —
Malicious Package in sailclothjs
Version 1.2.6 of `sailclothjs` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the pac…
-
Critical 9.8
Malicious Package in cal_rd
Version 0.1.1 of `rc_cal` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the package …
-
Low —
Denial of Service in grpc-ts-health-check
Versions of `grpc-ts-health-check` prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic …
-
High —
Prototype Pollution in mithril
Affected versions of `mithril`are vulnerable to prototype pollution. The function `parseQueryString` may allow a malicious user to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. A…
-
High —
Sandbox Breakout / Arbitrary Code Execution in notevil
Versions of `notevil` prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the `Function` constructor by not checking the return values of function calls. This allows attackers to access the …
-
Critical —
Path Traversal in f-serv
All versions of `f-serv` are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. ## Recommendation No fix is currently available. Consider using an altern…
-
Critical 9.8
Malicious Package in anarchy
All versions of `anarchy` contain malicious code. The package ran `rm - rf /` as an install script. ## Recommendation Remove the package from your environment.
-
High —
Cross-Site Scripting in console-feed
Versions of `console-feed` prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses `console-feed` and a malicious JavaScript payload was passed to a `console.log('%_', payl…
-
High —
Authentication Bypass in otpauth
Versions of `otpauth` prior to 3.2.8 are vulnerable to Authentication Bypass. The package's `totp.validate()` function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by pr…
-
Critical 9.8
Malicious Package in fast-requests
All versions of `fast-requests` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remove the…
-
Critical 9.8
Malicious Package in cage-js
All versions of `cage-js` contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secr…
-
Critical 9.8
Malicious Package in rate-map
Version 1.0.3 of `rate-map` contains malicious code. The malware breaks functionality of the `purescript-installer` package by rewriting code of the `dl-tar` dependency. ## Recommendation Upgrade to version 1.0.5 or later. There is no indication of further co…
-
High —
Cross-Site Scripting in dmn-js-properties-panel
Versions of `dmn-js-properties-panel` prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. ## Reco…
-
Critical 9.8
Malicious Package in load-from-cwd-or-npm
Version 3.0.2 of `load-from-cwd-or-npm` contains malicious code. The malware breaks functionality of the `purescript-installer` package by injecting targeted code. ## Recommendation Upgrade to version 3.0.4 or later. There is no indication of further compromi…
-
High —
Cross-Site Scripting in cmmn-js-properties-panel
Versions of `cmmn-js-properties-panel` prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. ## Rec…
-
High —
Cross-Site Scripting in bpmn-js-properties-panel
Versions of `bpmn-js-properties-panel` prior to 0.31.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. ## Re…
-
Low —
Regular Expression Denial of Service in marked
Affected versions of `marked` are vulnerable to Regular Expression Denial of Service (ReDoS). The `_label` subrule may significantly degrade parsing performance of malformed input. ## Recommendation Upgrade to version 0.7.0 or later.
-
Medium —
Local File Inclusion in domokeeper
All versions of `domokeeper` are vulnerable to Local File Inclusion. The `/plugin/` route passes a GET parameter unsanitized to a `require()` call. It then returns the output of `require()` in the server response. This may allow attackers to load unintended c…
-
Critical 9.8
Malicious Package in nodes.js
All versions of `nodes.js ` contain malicious code. The package searches and installs globally thousands of packages based on keywords `node`, `react`, `react-native`, `vue`, `angular` and `babel` to fill the system's memory. ## Recommendation Remove the pack…
-
Critical 9.8
Malicious Package in deasyncp
All versions of `deasyncp ` contain malicious code. The package shuts down the machine upon installation as a preinstall script. ## Recommendation Remove the package from your environment. There is no further compromise.
-
Critical 9.8
Malicious Package in sdfjghlkfjdshlkjdhsfg
All versions of `sdfjghlkfjdshlkjdhsfg` contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version. ## Recommendation Remove the pac…
-
High —
Prototype Pollution in lodash.mergewith
Versions of `lodash.mergewith` before 4.6.2 are vulnerable to prototype pollution. The function `mergeWith` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an exist…
-
High —
Prototype Pollution in lodash.defaultsdeep
Versions of `lodash.defaultsdeep` before 4.6.1 are vulnerable to Prototype Pollution. The function 'defaultsDeep' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that …
-
High —
Prototype Pollution in lodash.mergewith
Versions of `lodash.mergewith` before 4.6.1 are vulnerable to Prototype Pollution. The function 'mergeWith' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will e…
-
High —
Prototype Pollution in lodash.defaultsdeep
Versions of `lodash.defaultsdeep` before 4.6.1 are vulnerable to prototype pollution. The function `mergeWith` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an ex…
-
High —
Prototype Pollution in lodash.merge
Versions of `lodash.merge` before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on …
-
High —
Prototype Pollution in lodash.merge
Versions of `lodash.merge` before 4.6.2 are vulnerable to prototype pollution. The function `merge` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing prop…
-
Critical 9.8
Malicious Package in tiar
All versions of `tiar` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All s…
-
Critical 9.8
Malicious Package in secure_identity_login_module
All versions of `secure_identity_login_module` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered …
-
Critical 9.8
Malicious Package in river-mock
All versions of `river-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…