Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Critical 9.8
Malicious Package in retcodelog
All versions of `retcodelog` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…
-
Critical 9.8
Malicious Package in qingting
All versions of `qingting` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. A…
-
Critical 9.8
Malicious Package in node-buc
All versions of `node-buc` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. A…
-
Critical 9.8
Malicious Package in midway-dataproxy
All versions of `midway-dataproxy` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compro…
-
Critical 9.8
Malicious Package in midway-xtpl
All versions of `midway-xtpl` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised…
-
Critical 9.8
Malicious Package in hsf-clients
All versions of `hsf-clients` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised…
-
Critical 9.8
Malicious Package in luna-mock
All versions of `luna-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. …
-
Critical 9.8
Malicious Package in hpmm
All versions of `hpmm` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All s…
-
Critical 9.8
Malicious Package in cicada-render
All versions of `cicada-render` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromis…
-
Critical 9.8
Malicious Package in diamond-clien
All versions of `diamond-clien` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromis…
-
Critical 9.8
Malicious Package in appx-compiler
All versions of `appx-compiler` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromis…
-
Critical 9.8
Malicious Package in antd-cloud
All versions of `antd-cloud` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…
-
Critical 9.8
Malicious Package in alipayjsapi
All versions of `alipayjsapi` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised…
-
Critical 9.8
Malicious Package in alico
All versions of `alico` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All …
-
Critical 9.8
Malicious Package in ali-contributors
All versions of `ali-contributors` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compro…
-
Critical 9.8
Malicious Package in ali-contributor
All versions of `ali-contributor` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully comprom…
-
Critical 9.8
Malicious Package in only-test-not-install
All versions of `only-test-not-install` contain malicious code. The package deletes the folder `~/test` from the system as a postinstall script. ## Recommendation Remove the package from your environment. There are no further signs of compromise.
-
Critical 9.8
Malicious Package in my-very-own-package
All versions of `my-very-own-package` contain malicious code. The package sends the output of `process.versions`, `process.arch` and `process.platform` to a remote server in a postinstall script. ## Recommendation Remove the package from your environment. The…
-
Critical 9.8
Malicious Package in maybemaliciouspackage
All versions of `maybemaliciouspackage` contain malicious code. The package prints the system's SSH keys to the console as a postinstall script. ## Recommendation Remove the package from your environment. There are no further signs of compromise.
-
Critical 9.8
Malicious Package in leetlog
Versions 0.1.2 and 0.1.3 of `leetlog` contain malicious code. The package adds an arbitrary hardcoded SSH key identified as `hacker@evilmachine` to the system's `authorized_keys` ## Recommendation Any computer that has this package installed or running should…
-
Critical 9.8
Malicious Package in malicious-do-not-install
All versions of `malicious-do-not-install` contain malicious code. The package copies the contents of `/etc/passwd` and `/etc/shadow` to files in the local `/tmp/` folder. ## Recommendation Remove the package from your environment and rotate affected credenti…
-
Medium 6.5
Reverse Tabnabbing in quill
Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening l…
-
High —
Cross-Site Scripting in takeapeek
All versions of `takeapeek` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. ## Recommendation…
-
High —
Cross-Site Scripting in jquery.json-viewer
Versions of `jquery.json-viewer` prior to 1.3.0 are vulnerable to Cross-Site Scripting (XSS). The package insufficiently sanitizes user input when creating links, and concatenates the user input in an `<a>` tag. This allows attackers to create malicious links…
-
High —
Path Traversal in restify-swagger-jsdoc
Versions of `restify-swagger-jsdoc` prior to 3.2.1 are vulnerable to Path Traversal. The package fails to properly sanitize URLs, which may allow attackers to access server files outside the `swagger-ui` folder by using relative paths. ## Recommendation Upgra…
-
Critical —
Undefined Behavior in zencashjs
Versions of `zencashjs` prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH …
-
High —
Cross-Site Scripting in bleach
All versions of `bleach` are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as `"<<script><</script>script>alert('xss');</<script><</script>script>"` regardless of the passed options. This may a…
-
High —
Sandbox Breakout / Arbitrary Code Execution in safe-eval
All versions of `safe-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code. For example, the payload ``` ((() => { const targe…
-
Medium —
Open Redirect in apostrophe
Versions of `apostrophe` prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing `/` were appended at the end. ## Recommendation Update to version 2.92.0 or later.
-
High —
Cross-Site Scripting in graylog-web-interface
All versions of `graylog-web-interface` are vulnerable to Cross-Site Scripting (XSS). The package fails to escape output on the `TypeAhead` and `QueryInput` components, which may allow attackers to execute arbitrary JavaScript on the victim's browser. ## Reco…
-
High —
Path Traversal in zero
Versions of `zero` prior to 1.0.6 are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. ## Recommendation Upgrade to version 1.0.6 or later.
-
High —
Cross-Site Scripting in eco
All versions of `eco` are vulnerable to Cross-Site Scripting (XSS). The package's default `__escape` implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim's browser. ## Recommendation No fix is c…
-
Critical 9.8
Malicious Package in rpc-websocket
Versions of `rpc-websocket` >= 0.7.6 contained malicious code. The package opens a backdoor to a remote server and executes arbitrary commands, effectively acting as a backdoor. ## Recommendation Any computer that has these versions of the package installed o…
-
Critical 9.1
Malicious Package in cxt
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in degbu
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
High —
Cross-Site Scripting in @ionic/core
Versions of `@ionic/core` prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's …
-
Critical 9.1
Malicious Package in ecruve
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in dhkey
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in ecuvre
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in fs-extar
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…