Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Critical 9.8
Malicious Package in colro-name
Version 9.0.0 of `colro-name` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be considere…
-
Critical 9.8
Malicious Package in browserift
Version 16.3.3 of `browserift` contained malicious code as a preinstall script. The package was a backdoor that opened a connection to a remote server and executed incoming commands on both Unix and Windows machines ## Recommendation Any computer that has thi…
-
Critical 9.8
Malicious Package in bowe
Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be considered ful…
-
Critical 9.8
Malicious Package in whiteproject
All versions of `whiteproject` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remove the …
-
Critical 9.8
Malicious Package in bowee
Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be considered ful…
-
Critical 9.8
Malicious Package in saync
All versions of `saync ` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in reqest
All versions of `reqest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
High —
ag-grid Cross-Site Scripting vulnerability
Versions of `ag-grid` prior to 14.0.0 are vulnerable to Cross-Site Scripting (XSS). Grid contents are not properly sanitized and may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid. ## Recommendation Upgrade to version 14…
-
Critical 9.8
Malicious Package in destroyer-of-worlds
The package `destroyer-of-worlds` contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop.…
-
Medium —
Sandbox Breakout / Arbitrary Code Execution in value-censorship
All versions of `value-censorship` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code. ## Recommendation No fix is currently available. Cons…
-
Critical 9.8
Malicious Package in donotinstallthis
The package `donotinstallthis` contained malicious code. The package contained a script that was run as part of the install script. The script contacted a remote service tracking how many installations were done. There is no further compromise. ## Recommendat…
-
High —
Cross-Site Scripting in fomantic-ui
Versions of `fomantic-ui` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text. ## Recommendation Upgrade to version 2.7.0 or later.
-
High —
Cross-Site Scripting in jquery-mobile
All version of `jquery-mobile` are vulnerable to Cross-Site Scripting. The package checks for content in `location.hash` and if a URL is found it does an XmlHttpRequest (XHR) to the URL and renders the response with `innerHTML`. It fails to validate the `Cont…
-
Medium —
Cross-Site Scripting in google-closure-library
Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through M…
-
High —
Cross-Site Scripting in wangeditor
All versions of `wangeditor` are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers. ## Recommendation No fix is currently available. Consider using a…
-
Critical 9.8
Malicious Package in carloprojectdiscord
All versions of `carloprojectdiscord` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remo…
-
Critical 9.8
Malicious Package in discord_debug_log
All versions of `discord_debug_log` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remove…
-
Critical 9.8
Malicious Package in carloprojectlesang
All versions of `carloprojectlesang` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remov…
-
Critical 9.8
Malicious Package in erquest
All versions of `erquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in rqeuest
All versions of `rqeuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in requset
All versions of `requset` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in requets
All versions of `requets` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in requet
All versions of `requet` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in rrequest
All versions of `rrequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in reques
All versions of `reques` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in reequest
All versions of `reequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in reqquest
All versions of `reqquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in requuest
All versions of `requuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in requeest
All versions of `requeest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in requesst
All versions of `requesst` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in requestt
All versions of `requestt` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in calk
All versions of `calk` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the N…
-
Critical 9.8
Malicious Package in chak
All versions of `chak` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the N…
-
Critical 9.8
Malicious Package in eact
All versions of `eact` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the N…
-
Critical 9.8
Malicious Package in experss
All versions of `experss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in commnader
All versions of `commnader` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, …
-
Critical 9.8
Malicious Package in exprss
All versions of `exprss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in momen
All versions of `momen` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the …
-
Critical 9.8
Malicious Package in aysnc
All versions of `aysnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the …
-
Critical 9.8
Malicious Package in asnyc
All versions of `asnyc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the …