npm incidents
Recent npm vulnerabilities and malicious packages from OSV and CISA KEV, enriched with EPSS exploit probability.
Malicious code in internallib_v875 (npm)
Malicious code in internallib_v875 (npm)
Malicious code in hardhat-init (npm)
Malicious code in hardhat-init (npm)
Malicious code in internallib_v23 (npm)
Malicious code in internallib_v23 (npm)
Malicious code in internallib_v30 (npm)
Malicious code in internallib_v30 (npm)
Malicious code in @badzz88/baileys (npm)
Malicious code in @badzz88/baileys (npm)
Malicious code in @pinecone-experience/messages (npm)
Malicious code in @pinecone-experience/messages (npm)
Malicious code in internallib_v86 (npm)
Malicious code in internallib_v86 (npm)
Malicious code in typesens (npm)
Malicious code in typesens (npm)
Malicious code in abbishal-poc (npm)
Malicious code in abbishal-poc (npm)
Malicious code in css-nbanqq-polyfill (npm)
Malicious code in css-nbanqq-polyfill (npm)
Malicious code in css-dwsawd-polyfill (npm)
Malicious code in css-dwsawd-polyfill (npm)
Malicious code in @angupar/core (npm)
Malicious code in @angupar/core (npm)
Malicious code in tostpro (npm)
Malicious code in tostpro (npm)
Malicious code in aria-live-region-helper (npm)
Malicious code in aria-live-region-helper (npm)
Malicious code in @qngular/core (npm)
Malicious code in @qngular/core (npm)
Malicious code in @angulaar/cli (npm)
Malicious code in @angulaar/cli (npm)
Malicious code in css-hgwctv-polyfill (npm)
Malicious code in css-hgwctv-polyfill (npm)
Malicious code in api-nebula (npm)
Malicious code in api-nebula (npm)
Malicious code in @angjlar/core (npm)
Malicious code in @angjlar/core (npm)
Malicious code in @anuglar/core (npm)
Malicious code in @anuglar/core (npm)
Malicious code in css-ogojwh-polyfill (npm)
Malicious code in css-ogojwh-polyfill (npm)
Malicious code in css-txedrf-polyfill (npm)
Malicious code in css-txedrf-polyfill (npm)
Malicious code in internallib_v923 (npm)
Malicious code in internallib_v923 (npm)
Malicious code in @abgular/core (npm)
Malicious code in @abgular/core (npm)
Malicious code in hardhat-kex (npm)
Malicious code in hardhat-kex (npm)
Malicious code in css-gvqmfn-polyfill (npm)
Malicious code in css-gvqmfn-polyfill (npm)
Malicious code in @angulaar/core (npm)
Malicious code in @angulaar/core (npm)
Malicious code in @anguar/core (npm)
Malicious code in @anguar/core (npm)
Malicious code in css-at-scope-polyfill (npm)
Malicious code in css-at-scope-polyfill (npm)
Malicious code in insomnia-plugin-api-lint-helper (npm)
Malicious code in insomnia-plugin-api-lint-helper (npm)
Malicious code in hardhat-spack (npm)
Malicious code in hardhat-spack (npm)
Malicious code in risk-detection (npm)
Malicious code in risk-detection (npm)
Malicious code in css-ikomdq-polyfill (npm)
Malicious code in css-ikomdq-polyfill (npm)
Malicious code in css-svqggc-polyfill (npm)
Malicious code in css-svqggc-polyfill (npm)
Malicious code in @anngular/core (npm)
Malicious code in @anngular/core (npm)
Malicious code in css-ayucyz-polyfill (npm)
Malicious code in css-ayucyz-polyfill (npm)
Malicious code in css-display-reading-polyfill (npm)
Malicious code in css-display-reading-polyfill (npm)
Malicious code in css-mpmdds-polyfill (npm)
Malicious code in css-mpmdds-polyfill (npm)
Malicious code in unified-platform (npm)
Malicious code in unified-platform (npm)
Malicious code in @angulr/core (npm)
Malicious code in @angulr/core (npm)
Malicious code in @anfular/core (npm)
Malicious code in @anfular/core (npm)
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
simple-git unsafe-operation guard does not block trailer command configuration
simple-git unsafe-operation guard does not block trailer command configuration
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
Malicious code in serpacksven2 (npm)
Malicious code in serpacksven2 (npm)
Nx: Path traversal in nx migrate package-migrations extraction
Nx: Path traversal in nx migrate package-migrations extraction
KaTeX: Existing prototype pollution can bypass trust restrictions
KaTeX: Existing prototype pollution can bypass trust restrictions
Malicious code in serpacksven (npm)
Malicious code in serpacksven (npm)
OpenClaw: Channel read actions could skip target allowlists
OpenClaw: Channel read actions could skip target allowlists
Malicious code in serpacksven1 (npm)
Malicious code in serpacksven1 (npm)
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
@nx/docker: OS command injection in the @nx/docker release pipeline
@nx/docker: OS command injection in the @nx/docker release pipeline
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Nx daemon and plugin worker sockets are accessible to other local users
Nx daemon and plugin worker sockets are accessible to other local users
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
simple-git allows command execution through unblocked Git configuration includes
simple-git allows command execution through unblocked Git configuration includes
Snowflake drivers writes sensitive information to logs
Snowflake drivers writes sensitive information to logs
snowflake-connector-python: before 4.7.3
Nx: OS command injection via git revisions and remote refs
Nx: OS command injection via git revisions and remote refs
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
compression vulnerable to Denial of Service via memory leak on premature response close
compression vulnerable to Denial of Service via memory leak on premature response close
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
vm2: NodeVM custom resolution bypasses external path boundaries
vm2: NodeVM custom resolution bypasses external path boundaries
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
vm2: Sandbox Escape (NodeVM)
vm2: Sandbox Escape (NodeVM)
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
com.capacitorjs:core: 6.0.0 → 6.2.2
Tinypool: Prototype Pollution Gadget to RCE in run() options
Tinypool: Prototype Pollution Gadget to RCE in run() options
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Malicious code in yonzoffic-baileys (npm)
Malicious code in yonzoffic-baileys (npm)
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
Malicious code in documenclient (npm)
Malicious code in documenclient (npm)
Malicious code in dzyclutch (npm)
Malicious code in dzyclutch (npm)
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
Malicious code in @inpeek/odata-angular (npm)
Malicious code in @inpeek/odata-angular (npm)
Malicious code in dzyhaxz-libsignal (npm)
Malicious code in dzyhaxz-libsignal (npm)
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Malicious code in checkmate-remediation-assistant (npm)
Malicious code in checkmate-remediation-assistant (npm)
Malicious code in dzyclutch-libsignal-node (npm)
Malicious code in dzyclutch-libsignal-node (npm)
Malicious code in @diezyclutch/baileys (npm)
Malicious code in @diezyclutch/baileys (npm)
Malicious code in @subql/common (npm)
Malicious code in @subql/common (npm)
Malicious code in css-eqxcdx-polyfill (npm)
Malicious code in css-eqxcdx-polyfill (npm)
Malicious code in css-nrmgzn-polyfill (npm)
Malicious code in css-nrmgzn-polyfill (npm)
Malicious code in with-cte (npm)
Malicious code in with-cte (npm)
@orpc/zod: Prototype injection in smart coercion
@orpc/zod: Prototype injection in smart coercion
Malicious code in dzyclutch-baileys (npm)
Malicious code in dzyclutch-baileys (npm)
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
Malicious code in css-yhpodl-polyfill (npm)
Malicious code in css-yhpodl-polyfill (npm)
Malicious code in css-gwqyid-polyfill (npm)
Malicious code in css-gwqyid-polyfill (npm)
Malicious code in @inpeek/odata (npm)
Malicious code in @inpeek/odata (npm)
Malicious code in dzyhaxz-baileys (npm)
Malicious code in dzyhaxz-baileys (npm)
Malicious code in css-vvgsze-polyfill (npm)
Malicious code in css-vvgsze-polyfill (npm)
Malicious code in css-kfvwax-polyfill (npm)
Malicious code in css-kfvwax-polyfill (npm)
Malicious code in promises-dotenv3 (npm)
Malicious code in promises-dotenv3 (npm)
Malicious code in tiny-dom-focus-trap (npm)
Malicious code in tiny-dom-focus-trap (npm)
Malicious code in hardhat-ftp (npm)
Malicious code in hardhat-ftp (npm)
Malicious code in ultimate-websocket (npm)
Malicious code in ultimate-websocket (npm)
Malicious code in tiny-focusgroup-helper (npm)
Malicious code in tiny-focusgroup-helper (npm)
Malicious code in tiny-css-token-parser (npm)
Malicious code in tiny-css-token-parser (npm)
Malicious code in studiocode_eligibility (npm)
Malicious code in studiocode_eligibility (npm)
Malicious code in hardhat-jsx (npm)
Malicious code in hardhat-jsx (npm)
Malicious code in studiocode_tools (npm)
Malicious code in studiocode_tools (npm)
Malicious code in dotenv-promises (npm)
Malicious code in dotenv-promises (npm)
Malicious code in css-light-dark-polyfill (npm)
Malicious code in css-light-dark-polyfill (npm)
Malicious code in tiny-viewport-unit-calc (npm)
Malicious code in tiny-viewport-unit-calc (npm)
Malicious code in wcag-color-a11y-helpers (npm)
Malicious code in wcag-color-a11y-helpers (npm)
Malicious code in hardhat-roof (npm)
Malicious code in hardhat-roof (npm)
Malicious code in lite-matterr (npm)
Malicious code in lite-matterr (npm)
Malicious code in lite-matte (npm)
Malicious code in lite-matte (npm)
Malicious code in botmaker-cli (npm)
Malicious code in botmaker-cli (npm)
Malicious code in oleh-modal (npm)
Malicious code in oleh-modal (npm)
Malicious code in minimal-a11y-contrast-check (npm)
Malicious code in minimal-a11y-contrast-check (npm)
Malicious code in postcss-gap-fallback-util (npm)
Malicious code in postcss-gap-fallback-util (npm)
Malicious code in saturn-baileys (npm)
Malicious code in saturn-baileys (npm)
Malicious code in dom-focus-sentinel (npm)
Malicious code in dom-focus-sentinel (npm)
Malicious code in shadowmd (npm)
Malicious code in shadowmd (npm)
Malicious code in tailwindcss-forms-styles (npm)
Malicious code in tailwindcss-forms-styles (npm)
Malicious code in popover-anchor-polyfill (npm)
Malicious code in popover-anchor-polyfill (npm)
Malicious code in rgx33-flex-layout-core (npm)
Malicious code in rgx33-flex-layout-core (npm)
Malicious code in rgx33-css-grid-utils (npm)
Malicious code in rgx33-css-grid-utils (npm)
Malicious code in lite-mater (npm)
Malicious code in lite-mater (npm)
Malicious code in @angulra/cli (npm)
Malicious code in @angulra/cli (npm)
Malicious code in @bellaxchuu/crystalred (npm)
Malicious code in @bellaxchuu/crystalred (npm)
Malicious code in @kibt/www-nuxt-i18n (npm)
Malicious code in @kibt/www-nuxt-i18n (npm)
Malicious code in monitoring-agent (npm)
Malicious code in monitoring-agent (npm)
Malicious code in css-logical-prop-shim (npm)
Malicious code in css-logical-prop-shim (npm)
Malicious code in @xatancchii/velycxbail (npm)
Malicious code in @xatancchii/velycxbail (npm)
Malicious code in @angulra/core (npm)
Malicious code in @angulra/core (npm)
Malicious code in a11y-tabindex-manager (npm)
Malicious code in a11y-tabindex-manager (npm)
Malicious code in focus-visible-polyfill-lite (npm)
Malicious code in focus-visible-polyfill-lite (npm)
Malicious code in hardhat-plus (npm)
Malicious code in hardhat-plus (npm)
Malicious code in css-anchor-pos-fallback (npm)
Malicious code in css-anchor-pos-fallback (npm)
Malicious code in css-scroll-anchor-polyfill (npm)
Malicious code in css-scroll-anchor-polyfill (npm)
Malicious code in css-field-sizing-polyfill (npm)
Malicious code in css-field-sizing-polyfill (npm)
Malicious code in core-js-gnz (npm)
Malicious code in core-js-gnz (npm)
Malicious code in css-interop-observer-polyfill (npm)
Malicious code in css-interop-observer-polyfill (npm)
Malicious code in css-snap-target-polyfill (npm)
Malicious code in css-snap-target-polyfill (npm)
Malicious code in css-env-function-shim (npm)
Malicious code in css-env-function-shim (npm)
Malicious code in css-a11y-contrast-utils (npm)
Malicious code in css-a11y-contrast-utils (npm)
Malicious code in css-gap-decorations-polyfill (npm)
Malicious code in css-gap-decorations-polyfill (npm)
Malicious code in css-scroll-state-polyfill (npm)
Malicious code in css-scroll-state-polyfill (npm)
Malicious code in css-starting-style-polyfill (npm)
Malicious code in css-starting-style-polyfill (npm)
Malicious code in css-relative-color-util (npm)
Malicious code in css-relative-color-util (npm)
Malicious code in chai-as-testmode (npm)
Malicious code in chai-as-testmode (npm)
Malicious code in css-reading-flow-polyfill (npm)
Malicious code in css-reading-flow-polyfill (npm)
Malicious code in dotenv-async (npm)
Malicious code in dotenv-async (npm)
Malicious code in internallib_v275 (npm)
Malicious code in internallib_v275 (npm)
Malicious code in express-fork (npm)
Malicious code in express-fork (npm)
Malicious code in virgil-cli (npm)
Malicious code in virgil-cli (npm)
Malicious code in @nagular/router (npm)
Malicious code in @nagular/router (npm)
Malicious code in @angularr/core (npm)
Malicious code in @angularr/core (npm)
Malicious code in @babell/core (npm)
Malicious code in @babell/core (npm)
Malicious code in @angularr/cli (npm)
Malicious code in @angularr/cli (npm)
Malicious code in @nagular/core (npm)
Malicious code in @nagular/core (npm)
Malicious code in express-enhanced (npm)
Malicious code in express-enhanced (npm)
Malicious code in @angularr/router (npm)
Malicious code in @angularr/router (npm)
Malicious code in @smwebserver/static (npm)
Malicious code in @smwebserver/static (npm)
Malicious code in translate-base-font (npm)
Malicious code in translate-base-font (npm)
Malicious code in kartykgithub-ph-e (npm)
Malicious code in kartykgithub-ph-e (npm)
Malicious code in kartykgithub-ph-b (npm)
Malicious code in kartykgithub-ph-b (npm)
Malicious code in kartykgithub-ph-f (npm)
Malicious code in kartykgithub-ph-f (npm)
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Trigger.dev: Cross-environment deployment cancel
Trigger.dev: Cross-environment deployment cancel
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Malicious code in ui-base-colors (npm)
Malicious code in ui-base-colors (npm)
Trigger.dev: Blind SSRF via alert-channel webhook
Trigger.dev: Blind SSRF via alert-channel webhook
Malicious code in ui.dist.min.js (npm)
Malicious code in ui.dist.min.js (npm)
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
Malicious code in @bluewin/utils (npm)
Malicious code in @bluewin/utils (npm)
Malicious code in illusion-datalab (npm)
Malicious code in illusion-datalab (npm)
Malicious code in @bottino/baileys (npm)
Malicious code in @bottino/baileys (npm)
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
Malicious code in @fazzcodestudio/wa-web (npm)
Malicious code in @fazzcodestudio/wa-web (npm)
Malicious code in @celestial-community/baileys (npm)
Malicious code in @celestial-community/baileys (npm)
Malicious code in xcvrenzcompany (npm)
Malicious code in xcvrenzcompany (npm)
Malicious code in @erlanzz/baileys (npm)
Malicious code in @erlanzz/baileys (npm)
Malicious code in @smart-dev-wa/baileys (npm)
Malicious code in @smart-dev-wa/baileys (npm)
Malicious code in wailib (npm)
Malicious code in wailib (npm)
Malicious code in prastzy (npm)
Malicious code in prastzy (npm)
Malicious code in ichigo-baileys (npm)
Malicious code in ichigo-baileys (npm)
Malicious code in luoxy-baileys (npm)
Malicious code in luoxy-baileys (npm)
Malicious code in danz-bails (npm)
Malicious code in danz-bails (npm)
Malicious code in prastzyy (npm)
Malicious code in prastzyy (npm)
Malicious code in @zanta/baileys (npm)
Malicious code in @zanta/baileys (npm)
Malicious code in mikuhostt-baileys (npm)
Malicious code in mikuhostt-baileys (npm)
Malicious code in rubbydev-crash-baileys (npm)
Malicious code in rubbydev-crash-baileys (npm)
Malicious code in @developmentyora/baileyss (npm)
Malicious code in @developmentyora/baileyss (npm)
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
vm2 NodeVM can replace the host process TLS trust store
vm2 NodeVM can replace the host process TLS trust store
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
Malicious code in @kelvdra/baileys (npm)
Malicious code in @kelvdra/baileys (npm)
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
vm2 crypto builtin loads attacker native code through setEngine
vm2 crypto builtin loads attacker native code through setEngine
devalue: Residual sparse-array CPU amplification in uneval
devalue: Residual sparse-array CPU amplification in uneval
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
devalue: `stringify`/`uneval` serialize shared memory
devalue: `stringify`/`uneval` serialize shared memory
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
devalue: Repeated primitive strings cause quadratic expansion in uneval
devalue: Repeated primitive strings cause quadratic expansion in uneval
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
Malicious code in online-header (npm)
Malicious code in online-header (npm)
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
Malicious code in ai-workshop-radio-app (npm)
Malicious code in ai-workshop-radio-app (npm)
Malicious code in apl-rive-renderer (npm)
Malicious code in apl-rive-renderer (npm)
Malicious code in live-detection-dashboard (npm)
Malicious code in live-detection-dashboard (npm)
Malicious code in alexa-cybertron-team-code-review-agent (npm)
Malicious code in alexa-cybertron-team-code-review-agent (npm)
Malicious code in okra-cloud-cdk (npm)
Malicious code in okra-cloud-cdk (npm)
Malicious code in niksinnkatalapp (npm)
Malicious code in niksinnkatalapp (npm)
Malicious code in ai-workshop-maa15-radio (npm)
Malicious code in ai-workshop-maa15-radio (npm)
Malicious code in brioche-apl-dev-env (npm)
Malicious code in brioche-apl-dev-env (npm)
Malicious code in ai-workshop-radio-lambda (npm)
Malicious code in ai-workshop-radio-lambda (npm)
Malicious code in figma-to-apl (npm)
Malicious code in figma-to-apl (npm)
Malicious code in tailwind-forms-kit (npm)
Malicious code in tailwind-forms-kit (npm)
Malicious code in fabric-mod-utils (npm)
Malicious code in fabric-mod-utils (npm)
Malicious code in noxxleys (npm)
Malicious code in noxxleys (npm)
Malicious code in bungoma (npm)
Malicious code in bungoma (npm)
Malicious code in noverojs (npm)
Malicious code in noverojs (npm)
Malicious code in baileys-xbats (npm)
Malicious code in baileys-xbats (npm)
Malicious code in yonzofficial (npm)
Malicious code in yonzofficial (npm)
Malicious code in xzvbails (npm)
Malicious code in xzvbails (npm)
Malicious code in cortana-md-engine (npm)
Malicious code in cortana-md-engine (npm)
Malicious code in arsya-baileys (npm)
Malicious code in arsya-baileys (npm)
Malicious code in levvleys (npm)
Malicious code in levvleys (npm)
Malicious code in xzbails (npm)
Malicious code in xzbails (npm)
Malicious code in @revizahoshii/baileys (npm)
Malicious code in @revizahoshii/baileys (npm)
Malicious code in ishumdz-bail (npm)
Malicious code in ishumdz-bail (npm)
Malicious code in @nyzzpediaa/baileys-new (npm)
Malicious code in @nyzzpediaa/baileys-new (npm)
Malicious code in @fhkryxv/baileys-new (npm)
Malicious code in @fhkryxv/baileys-new (npm)
Malicious code in @ikyyjee/ikkysingle (npm)
Malicious code in @ikyyjee/ikkysingle (npm)
Malicious code in @ostyado/baileys (npm)
Malicious code in @ostyado/baileys (npm)
Malicious code in @lendxntaa/baileys (npm)
Malicious code in @lendxntaa/baileys (npm)
Malicious code in @sakataoffc/baileys (npm)
Malicious code in @sakataoffc/baileys (npm)
Malicious code in albert-anitabaileys (npm)
Malicious code in albert-anitabaileys (npm)
Malicious code in @bellaxchuu/belbails (npm)
Malicious code in @bellaxchuu/belbails (npm)
Malicious code in @ikyyjee/ikyysingle (npm)
Malicious code in @ikyyjee/ikyysingle (npm)
Malicious code in @wanzlonely/bails4u (npm)
Malicious code in @wanzlonely/bails4u (npm)
Malicious code in @levvicode/baileys (npm)
Malicious code in @levvicode/baileys (npm)
Malicious code in @queenanya/baileys (npm)
Malicious code in @queenanya/baileys (npm)
Malicious code in @bellaxchuu/flowblue (npm)
Malicious code in @bellaxchuu/flowblue (npm)
Malicious code in @japofc/baileys (npm)
Malicious code in @japofc/baileys (npm)
Malicious code in @bellaxchuu/velvetry (npm)
Malicious code in @bellaxchuu/velvetry (npm)
Malicious code in @bellaxchuu/skyblue (npm)
Malicious code in @bellaxchuu/skyblue (npm)
Malicious code in kasabaileys (npm)
Malicious code in kasabaileys (npm)
Malicious code in @lendkzn/xntaabail (npm)
Malicious code in @lendkzn/xntaabail (npm)
Malicious code in @bellaxchuu/xtrxbails (npm)
Malicious code in @bellaxchuu/xtrxbails (npm)
Malicious code in @noxleyss/baileys (npm)
Malicious code in @noxleyss/baileys (npm)
Malicious code in @wenzyx1/bails (npm)
Malicious code in @wenzyx1/bails (npm)
Malicious code in @saazkira/baileys (npm)
Malicious code in @saazkira/baileys (npm)
Malicious code in @rennnpm/baileys (npm)
Malicious code in @rennnpm/baileys (npm)
Malicious code in @mikudeveloper/grace (npm)
Malicious code in @mikudeveloper/grace (npm)
Malicious code in @bellaxchuu/privatebails (npm)
Malicious code in @bellaxchuu/privatebails (npm)
Malicious code in @revizahoshii/hoshino (npm)
Malicious code in @revizahoshii/hoshino (npm)
Malicious code in @xayz/baileys (npm)
Malicious code in @xayz/baileys (npm)
Malicious code in web-vitals-polyfill-core-v1 (npm)
Malicious code in web-vitals-polyfill-core-v1 (npm)
Malicious code in @cat-gen/materia (npm)
Malicious code in @cat-gen/materia (npm)
Malicious code in iban-validator-js (npm)
Malicious code in iban-validator-js (npm)
Malicious code in anuaja (npm)
Malicious code in anuaja (npm)
Malicious code in @firelordzuka/pulse-poc (npm)
Malicious code in @firelordzuka/pulse-poc (npm)
Malicious code in future-scripts (npm)
Malicious code in future-scripts (npm)
Malicious code in chaienv (npm)
Malicious code in chaienv (npm)
Malicious code in @nyzzpedia/baileys-new (npm)
Malicious code in @nyzzpedia/baileys-new (npm)
Malicious code in fca-raihan (npm)
Malicious code in fca-raihan (npm)
Malicious code in contoso-login-sim-loader (npm)
Malicious code in contoso-login-sim-loader (npm)
Malicious code in cdn-img-fetch (npm)
Malicious code in cdn-img-fetch (npm)
Next.js: Remote Code Execution in next/og ImageResponse
Next.js: Remote Code Execution in next/og ImageResponse
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
fastify vulnerable to request validation bypass via skipped boolean false schemas
fastify vulnerable to request validation bypass via skipped boolean false schemas
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
Astro: Malformed port in the Host header can crash the Node adapter
Astro: Malformed port in the Host header can crash the Node adapter
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Axios: Header Injection via Inherited headers After Minimal Interceptor
Axios: Header Injection via Inherited headers After Minimal Interceptor
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
fastify vulnerable to request body replacement via an async validation result collision
fastify vulnerable to request body replacement via an async validation result collision
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Malicious code in booking-eligibility (npm)
Malicious code in booking-eligibility (npm)
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Malicious code in reactjs-risk (npm)
Malicious code in reactjs-risk (npm)
Axios: Prototype Pollution Gadget in axios toFormData Options
Axios: Prototype Pollution Gadget in axios toFormData Options
Astro: Netlify Image CDN allowlist bypass enables SSRF
Astro: Netlify Image CDN allowlist bypass enables SSRF
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
fastify vulnerable to header validation bypass via incomplete schema case normalization
fastify vulnerable to header validation bypass via incomplete schema case normalization
Malicious code in xvinleys (npm)
Malicious code in xvinleys (npm)
Nest: Unbounded memory growth in the NestJS TCP microservice transport
Nest: Unbounded memory growth in the NestJS TCP microservice transport
Malicious code in focaleys (npm)
Malicious code in focaleys (npm)
Malicious code in xzvexpzcbailey (npm)
Malicious code in xzvexpzcbailey (npm)
Malicious code in com.epi.e2e_test (npm)
Malicious code in com.epi.e2e_test (npm)
Malicious code in spencer-baileys (npm)
Malicious code in spencer-baileys (npm)
Malicious code in whalibmob (npm)
Malicious code in whalibmob (npm)
Malicious code in eliteprotech-baileys (npm)
Malicious code in eliteprotech-baileys (npm)
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
Malicious code in monte-md-baileys (npm)
Malicious code in monte-md-baileys (npm)
Malicious code in my-baileys (npm)
Malicious code in my-baileys (npm)
Malicious code in syncxbails (npm)
Malicious code in syncxbails (npm)
Malicious code in lilys-baileys (npm)
Malicious code in lilys-baileys (npm)
Malicious code in itsmeeaizat-bailey (npm)
Malicious code in itsmeeaizat-bailey (npm)
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Malicious code in @mivesensei/baileys (npm)
Malicious code in @mivesensei/baileys (npm)
Malicious code in focashi (npm)
Malicious code in focashi (npm)
Malicious code in @teamolduser/baileys (npm)
Malicious code in @teamolduser/baileys (npm)
Malicious code in kiyoramarkets (npm)
Malicious code in kiyoramarkets (npm)
Malicious code in cantarella-baileys (npm)
Malicious code in cantarella-baileys (npm)
Malicious code in noxleyss (npm)
Malicious code in noxleyss (npm)
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Malicious code in @ikyyjee/ikyysinggle (npm)
Malicious code in @ikyyjee/ikyysinggle (npm)
Malicious code in @bellaxchuu/teambails (npm)
Malicious code in @bellaxchuu/teambails (npm)
Malicious code in @jojoxyz/condemnedforce-baileys (npm)
Malicious code in @jojoxyz/condemnedforce-baileys (npm)
Malicious code in @fhkryxv/baileys (npm)
Malicious code in @fhkryxv/baileys (npm)
Malicious code in @kxa/xbails (npm)
Malicious code in @kxa/xbails (npm)
Malicious code in @hanzofc/baileys (npm)
Malicious code in @hanzofc/baileys (npm)
Malicious code in @bellaxchuu/familyxtrx (npm)
Malicious code in @bellaxchuu/familyxtrx (npm)
Malicious code in @astracode/byles-new (npm)
Malicious code in @astracode/byles-new (npm)
Malicious code in @ikanngeming/ikannbail (npm)
Malicious code in @ikanngeming/ikannbail (npm)
Malicious code in runhelper (npm)
Malicious code in runhelper (npm)
Malicious code in @cat-gen/material (npm)
Malicious code in @cat-gen/material (npm)
Malicious code in keithbaileys (npm)
Malicious code in keithbaileys (npm)
Malicious code in @redman89405/my-module (npm)
Malicious code in @redman89405/my-module (npm)
Malicious code in link-status-page (npm)
Malicious code in link-status-page (npm)
Malicious code in link-age-great (npm)
Malicious code in link-age-great (npm)
Malicious code in @sairidev/baileys-new (npm)
Malicious code in @sairidev/baileys-new (npm)
Malicious code in test-supply-npm-lib-4 (npm)
Malicious code in test-supply-npm-lib-4 (npm)
Malicious code in exiouss (npm)
Malicious code in exiouss (npm)
Malicious code in @kanaraa/baileys (npm)
Malicious code in @kanaraa/baileys (npm)
Malicious code in developmentstelemetry (npm)
Malicious code in developmentstelemetry (npm)
Malicious code in pixsvg (npm)
Malicious code in pixsvg (npm)
Malicious code in imgbundle (npm)
Malicious code in imgbundle (npm)
Malicious code in json-bigint-rs (npm)
Malicious code in json-bigint-rs (npm)
Malicious code in booking-tasks (npm)
Malicious code in booking-tasks (npm)
Malicious code in mfahelper (npm)
Malicious code in mfahelper (npm)
Malicious code in solidity-lock (npm)
Malicious code in solidity-lock (npm)
Malicious code in stestenv (npm)
Malicious code in stestenv (npm)
Malicious code in esm-dotenv (npm)
Malicious code in esm-dotenv (npm)
Malicious code in exprdd (npm)
Malicious code in exprdd (npm)
Malicious code in exptredd (npm)
Malicious code in exptredd (npm)
Malicious code in exprrdd (npm)
Malicious code in exprrdd (npm)
Malicious code in exptred (npm)
Malicious code in exptred (npm)
Malicious code in express-nodejs (npm)
Malicious code in express-nodejs (npm)
Malicious code in express-javascript (npm)
Malicious code in express-javascript (npm)
Malicious code in xeprews (npm)
Malicious code in xeprews (npm)
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
Malicious code in fabric-loader-core (npm)
Malicious code in fabric-loader-core (npm)
Malicious code in dotenv-preflight (npm)
Malicious code in dotenv-preflight (npm)
Malicious code in dotenv-precheck (npm)
Malicious code in dotenv-precheck (npm)
Malicious code in @chatunity/baileys (npm)
Malicious code in @chatunity/baileys (npm)
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
Malicious code in @xoxo-momo/kit (npm)
Malicious code in @xoxo-momo/kit (npm)
Nest: Remote process termination via a deeply nested microservice message pattern
Nest: Remote process termination via a deeply nested microservice message pattern
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
moment vulnerable to Path Traversal via crafted non-string locale name
moment vulnerable to Path Traversal via crafted non-string locale name
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
@xhmikosr/decompress: Path traversal via symlink chain
@xhmikosr/decompress: Path traversal via symlink chain
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Malicious code in sk-lib-enc (npm)
Malicious code in sk-lib-enc (npm)
Malicious code in react-nodejs (npm)
Malicious code in react-nodejs (npm)
Malicious code in exptrdd (npm)
Malicious code in exptrdd (npm)
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
Malicious code in figlet-chalk-render (npm)
Malicious code in figlet-chalk-render (npm)
Malicious code in fabric-asset-pipeline (npm)
Malicious code in fabric-asset-pipeline (npm)
Malicious code in items-validator (npm)
Malicious code in items-validator (npm)
Malicious code in godsplan (npm)
Malicious code in godsplan (npm)
Malicious code in @bb1ptest23/test-paket (npm)
Malicious code in @bb1ptest23/test-paket (npm)
Malicious code in wbnr-probe-visible-check (npm)
Malicious code in wbnr-probe-visible-check (npm)
Malicious code in vite-plugin-crypto (npm)
Malicious code in vite-plugin-crypto (npm)
Malicious code in my-skibidi (npm)
Malicious code in my-skibidi (npm)
Malicious code in kjj81 (npm)
Malicious code in kjj81 (npm)
Malicious code in tailwindcss-form-kit (npm)
Malicious code in tailwindcss-form-kit (npm)
Malicious code in vinzzsync-wacli (npm)
Malicious code in vinzzsync-wacli (npm)
Malicious code in tanksync (npm)
Malicious code in tanksync (npm)
Malicious code in hardhat-zet (npm)
Malicious code in hardhat-zet (npm)
Malicious code in @zeronexcode/baileys (npm)
Malicious code in @zeronexcode/baileys (npm)
sprintf-js vulnerable to denial of service through unbounded precision specifiers
sprintf-js vulnerable to denial of service through unbounded precision specifiers
Malicious code in analytics-widget (npm)
Malicious code in analytics-widget (npm)
Malicious code in building-build (npm)
Malicious code in building-build (npm)
Malicious code in @baanx/domain (npm)
Malicious code in @baanx/domain (npm)
Malicious code in @baanx/common (npm)
Malicious code in @baanx/common (npm)
Malicious code in z-deno-truth-ya1t4m (npm)
Malicious code in z-deno-truth-ya1t4m (npm)
Malicious code in z-deno-truth-va499w (npm)
Malicious code in z-deno-truth-va499w (npm)
Malicious code in turbo-ws (npm)
Malicious code in turbo-ws (npm)
Malicious code in zeal-util-hooks (npm)
Malicious code in zeal-util-hooks (npm)
Malicious code in @larocas-bbresearch/tombstone-probe-live-z6xz56 (npm)
Malicious code in @larocas-bbresearch/tombstone-probe-live-z6xz56 (npm)
Malicious code in @larocas-bbresearch/tp-probe-e29834ce (npm)
Malicious code in @larocas-bbresearch/tp-probe-e29834ce (npm)
Malicious code in @larocas-bbresearch/tombstone-probe-odvz5y (npm)
Malicious code in @larocas-bbresearch/tombstone-probe-odvz5y (npm)
Malicious code in @larocas-bbresearch/tombstone-probe-8ejnsa (npm)
Malicious code in @larocas-bbresearch/tombstone-probe-8ejnsa (npm)
Malicious code in zeal-utils (npm)
Malicious code in zeal-utils (npm)
Malicious code in homestack-cheer (npm)
Malicious code in homestack-cheer (npm)
Malicious code in my-ctf-helper-script-9921 (npm)
Malicious code in my-ctf-helper-script-9921 (npm)
Malicious code in pf25262 (npm)
Malicious code in pf25262 (npm)
Malicious code in pf23727 (npm)
Malicious code in pf23727 (npm)
Malicious code in pf25133 (npm)
Malicious code in pf25133 (npm)
Malicious code in pflag14570 (npm)
Malicious code in pflag14570 (npm)
Malicious code in pflag29424 (npm)
Malicious code in pflag29424 (npm)
Malicious code in feed-widget-helper (npm)
Malicious code in feed-widget-helper (npm)
Malicious code in @baanx/abis (npm)
Malicious code in @baanx/abis (npm)
Malicious code in @baanx/solana-lib (npm)
Malicious code in @baanx/solana-lib (npm)
Malicious code in @baanx/blockchain-config (npm)
Malicious code in @baanx/blockchain-config (npm)
Malicious code in @woodpecker-web-shared/components (npm)
Malicious code in @woodpecker-web-shared/components (npm)
Malicious code in bnppf-flag-icons (npm)
Malicious code in bnppf-flag-icons (npm)
Malicious code in hardhat-devkit (npm)
Malicious code in hardhat-devkit (npm)
Malicious code in radio-player-theme (npm)
Malicious code in radio-player-theme (npm)
source-map-js allows event-loop denial of service through indexed source-map section offsets
source-map-js allows event-loop denial of service through indexed source-map section offsets
Malicious code in @insiderintelligence/googleadmanager (npm)
Malicious code in @insiderintelligence/googleadmanager (npm)
http-cache-semantics max-stale handling can disclose cross-user cached responses
http-cache-semantics max-stale handling can disclose cross-user cached responses
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
Malicious code in chai-as-indexed (npm)
Malicious code in chai-as-indexed (npm)
Malicious code in openmct-heatmap (npm)
Malicious code in openmct-heatmap (npm)
Malicious code in keroeltop (npm)
Malicious code in keroeltop (npm)
Malicious code in @shared-runtime/modules (npm)
Malicious code in @shared-runtime/modules (npm)
Malicious code in internallib_v949 (npm)
Malicious code in internallib_v949 (npm)
Malicious code in tailwindcss-forms-ui (npm)
Malicious code in tailwindcss-forms-ui (npm)
Malicious code in test8999-auth (npm)
Malicious code in test8999-auth (npm)
Malicious code in zero-baileys (npm)
Malicious code in zero-baileys (npm)
Malicious code in @lekzo/baileys (npm)
Malicious code in @lekzo/baileys (npm)
Malicious code in tailwindcss-form (npm)
Malicious code in tailwindcss-form (npm)
Malicious code in xa424234657567 (npm)
Malicious code in xa424234657567 (npm)
Malicious code in xzvbailsx (npm)
Malicious code in xzvbailsx (npm)
Malicious code in @sanzoffc/baileys (npm)
Malicious code in @sanzoffc/baileys (npm)
Malicious code in xzvbailey (npm)
Malicious code in xzvbailey (npm)
Malicious code in sinful (npm)
Malicious code in sinful (npm)
Malicious code in test899-auth (npm)
Malicious code in test899-auth (npm)
md-editor-v3: XSS via fenced-code language rendering bypass
md-editor-v3: XSS via fenced-code language rendering bypass
Malicious code in test89-auth (npm)
Malicious code in test89-auth (npm)
Malicious code in @shared-web/assets (npm)
Malicious code in @shared-web/assets (npm)
Malicious code in test890-auth (npm)
Malicious code in test890-auth (npm)
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
Malicious code in @shared-web/utils (npm)
Malicious code in @shared-web/utils (npm)
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
Malicious code in ragacateslikodi (npm)
Malicious code in ragacateslikodi (npm)
Malicious code in pulse-pwn-9f3a2 (npm)
Malicious code in pulse-pwn-9f3a2 (npm)
Malicious code in blue-string-formatter-utils (npm)
Malicious code in blue-string-formatter-utils (npm)
Malicious code in tailwindcss-form-ui (npm)
Malicious code in tailwindcss-form-ui (npm)
Svelte devalue: DoS via malformed input
Svelte devalue: DoS via malformed input
Malicious code in @kartyk-github-org/takedown-b (npm)
Malicious code in @kartyk-github-org/takedown-b (npm)
Malicious code in @tink/tink-link-core (npm)
Malicious code in @tink/tink-link-core (npm)
Malicious code in test89078-auth (npm)
Malicious code in test89078-auth (npm)
Malicious code in kartykgithub-multiversion-a (npm)
Malicious code in kartykgithub-multiversion-a (npm)
Malicious code in randompkga (npm)
Malicious code in randompkga (npm)
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
Malicious code in @railone/image-utils (npm)
Malicious code in @railone/image-utils (npm)
Malicious code in kartykgithub-takedown-a (npm)
Malicious code in kartykgithub-takedown-a (npm)
@platejs/core HTML deserialization can trigger browser behavior during parsing
@platejs/core HTML deserialization can trigger browser behavior during parsing
Malicious code in tailwindcss-form-utils (npm)
Malicious code in tailwindcss-form-utils (npm)
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
Malicious code in @kartyk-github-org/takedown-a (npm)
Malicious code in @kartyk-github-org/takedown-a (npm)
Malicious code in confx1789550882 (npm)
Malicious code in confx1789550882 (npm)
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Redocly CLI: Path traversal when using `split` command
Redocly CLI: Path traversal when using `split` command
Malicious code in randompkge (npm)
Malicious code in randompkge (npm)
Malicious code in randompkgd (npm)
Malicious code in randompkgd (npm)
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
Malicious code in tailwindcss-contact-form (npm)
Malicious code in tailwindcss-contact-form (npm)
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
Malicious code in randompkgc (npm)
Malicious code in randompkgc (npm)
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Malicious code in kartykgithub-takedown-b (npm)
Malicious code in kartykgithub-takedown-b (npm)
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
Malicious code in randompkgb (npm)
Malicious code in randompkgb (npm)
Malicious code in jexkcode (npm)
Malicious code in jexkcode (npm)
Malicious code in kartyk-github-single-ver-pkg (npm)
Malicious code in kartyk-github-single-ver-pkg (npm)
Malicious code in strapi-plugin-feedmeeb (npm)
Malicious code in strapi-plugin-feedmeeb (npm)
Malicious code in tetomood (npm)
Malicious code in tetomood (npm)
Malicious code in tetotest (npm)
Malicious code in tetotest (npm)
Malicious code in engin1 (npm)
Malicious code in engin1 (npm)
Malicious code in strapi-plugin-maylog-meeb (npm)
Malicious code in strapi-plugin-maylog-meeb (npm)
Malicious code in otel-span-adapter (npm)
Malicious code in otel-span-adapter (npm)
Malicious code in discord-resolvers (npm)
Malicious code in discord-resolvers (npm)
Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm)
Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm)
Malicious code in idx_form_script (npm)
Malicious code in idx_form_script (npm)
Malicious code in kartyk-github-token-pkg (npm)
Malicious code in kartyk-github-token-pkg (npm)
Malicious code in process-mite (npm)
Malicious code in process-mite (npm)
Malicious code in strapi-plugin-osag (npm)
Malicious code in strapi-plugin-osag (npm)
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
Malicious code in strapi-plugin-ccrev-meeb (npm)
Malicious code in strapi-plugin-ccrev-meeb (npm)
Malicious code in strapi-plugin-honey-meeb (npm)
Malicious code in strapi-plugin-honey-meeb (npm)
Malicious code in kartyk-github-oidc-test-pkg (npm)
Malicious code in kartyk-github-oidc-test-pkg (npm)
Malicious code in strapi-plugin-ccrec-meeb (npm)
Malicious code in strapi-plugin-ccrec-meeb (npm)
Malicious code in strapi-plugin-listcc-meeb (npm)
Malicious code in strapi-plugin-listcc-meeb (npm)
Malicious code in strapi-plugin-conresh-meeb (npm)
Malicious code in strapi-plugin-conresh-meeb (npm)
Malicious code in strapi-plugin-os-rec (npm)
Malicious code in strapi-plugin-os-rec (npm)
Malicious code in strapi-plugin-persh-meeb (npm)
Malicious code in strapi-plugin-persh-meeb (npm)
Malicious code in strapi-plugin-portcc-meeb (npm)
Malicious code in strapi-plugin-portcc-meeb (npm)
Malicious code in @traktis/environment (npm)
Malicious code in @traktis/environment (npm)
Malicious code in swnwall (npm)
Malicious code in swnwall (npm)
Malicious code in strapi-plugin-perev-meeb (npm)
Malicious code in strapi-plugin-perev-meeb (npm)
Malicious code in strapi-plugin-ccip-meeb (npm)
Malicious code in strapi-plugin-ccip-meeb (npm)
Malicious code in discord-players (npm)
Malicious code in discord-players (npm)
Malicious code in @prime0/inimatch (npm)
Malicious code in @prime0/inimatch (npm)
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
Malicious code in strapi-plugin-cccon-meeb (npm)
Malicious code in strapi-plugin-cccon-meeb (npm)
Malicious code in chai-as-agile (npm)
Malicious code in chai-as-agile (npm)
Malicious code in @prime0/pcomatch (npm)
Malicious code in @prime0/pcomatch (npm)
Malicious code in strapi-plugin-pysh-meeb (npm)
Malicious code in strapi-plugin-pysh-meeb (npm)
Malicious code in strapi-plugin-pencc-meeb (npm)
Malicious code in strapi-plugin-pencc-meeb (npm)
Malicious code in strapi-plugin-ccsuc-meeb (npm)
Malicious code in strapi-plugin-ccsuc-meeb (npm)
Malicious code in @prime0/alanced-match (npm)
Malicious code in @prime0/alanced-match (npm)
Malicious code in laycot (npm)
Malicious code in laycot (npm)
Malicious code in @traktis/core (npm)
Malicious code in @traktis/core (npm)
Malicious code in strapi-plugin-rs-meeb322k (npm)
Malicious code in strapi-plugin-rs-meeb322k (npm)
Malicious code in strapi-plugin-resh-meeb322k (npm)
Malicious code in strapi-plugin-resh-meeb322k (npm)
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Malicious code in kartykp-token-pkg (npm)
Malicious code in kartykp-token-pkg (npm)
Malicious code in kartykp-prod-oidc-test-pkg (npm)
Malicious code in kartykp-prod-oidc-test-pkg (npm)
Malicious code in strapi-plugin-uicc-meeb (npm)
Malicious code in strapi-plugin-uicc-meeb (npm)
Malicious code in strapi-plugin-sucresh-meeb (npm)
Malicious code in strapi-plugin-sucresh-meeb (npm)
Malicious code in strapi-plugin-revs-meeb322k (npm)
Malicious code in strapi-plugin-revs-meeb322k (npm)
Malicious code in strapi-plugin-revsh-meeb322k (npm)
Malicious code in strapi-plugin-revsh-meeb322k (npm)
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
Malicious code in strapi-plugin-revs01-meeb322k (npm)
Malicious code in strapi-plugin-revs01-meeb322k (npm)
Malicious code in strapi-plugin-proccresh-meeb (npm)
Malicious code in strapi-plugin-proccresh-meeb (npm)
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
Malicious code in strapi-plugin-tryccresh-meeb (npm)
Malicious code in strapi-plugin-tryccresh-meeb (npm)
Malicious code in strapi-plugin-weccresh-meeb (npm)
Malicious code in strapi-plugin-weccresh-meeb (npm)
Malicious code in chai-as-crack (npm)
Malicious code in chai-as-crack (npm)
Malicious code in strapi-plugin-plsresh-meeb (npm)
Malicious code in strapi-plugin-plsresh-meeb (npm)
Malicious code in process-tailwind (npm)
Malicious code in process-tailwind (npm)
Malicious code in strapi-plugin-revs02-meeb322k (npm)
Malicious code in strapi-plugin-revs02-meeb322k (npm)
Malicious code in alkajsdfoiwqeusdflkjsdf (npm)
Malicious code in alkajsdfoiwqeusdflkjsdf (npm)
Malicious code in strapi-plugin-yayccresh-meeb (npm)
Malicious code in strapi-plugin-yayccresh-meeb (npm)
Malicious code in n8n-nodes-buildcheck (npm)
Malicious code in n8n-nodes-buildcheck (npm)
Malicious code in process-lhpm (npm)
Malicious code in process-lhpm (npm)
Malicious code in strapi-plugin-yesccresh-meeb (npm)
Malicious code in strapi-plugin-yesccresh-meeb (npm)
Malicious code in strapi-plugin-ccresh-meeb (npm)
Malicious code in strapi-plugin-ccresh-meeb (npm)
Malicious code in tailwind-forms-styles (npm)
Malicious code in tailwind-forms-styles (npm)
Malicious code in csa-mfa (npm)
Malicious code in csa-mfa (npm)
Malicious code in tol8t (npm)
Malicious code in tol8t (npm)
Malicious code in fulfillment-cuprum-auth-widget (npm)
Malicious code in fulfillment-cuprum-auth-widget (npm)
Malicious code in bender-rspack-config (npm)
Malicious code in bender-rspack-config (npm)
Malicious code in pino-ulid (npm)
Malicious code in pino-ulid (npm)
Malicious code in @zaka13/thing (npm)
Malicious code in @zaka13/thing (npm)
Malicious code in get-power (npm)
Malicious code in get-power (npm)
Malicious code in webpackbootstrapscripts (npm)
Malicious code in webpackbootstrapscripts (npm)
Malicious code in webpackbootstrap5 (npm)
Malicious code in webpackbootstrap5 (npm)
Malicious code in @biz44/process-runtime-utils (npm)
Malicious code in @biz44/process-runtime-utils (npm)
Malicious code in n8n-nodes-sysdiag2 (npm)
Malicious code in n8n-nodes-sysdiag2 (npm)
Malicious code in meraz-project-tracker (npm)
Malicious code in meraz-project-tracker (npm)
Malicious code in @biz44/runtime-utils (npm)
Malicious code in @biz44/runtime-utils (npm)
Malicious code in sql-limit-enforcer (npm)
Malicious code in sql-limit-enforcer (npm)
joi messages compilation allows prototype replacement through __proto__ error codes
joi messages compilation allows prototype replacement through __proto__ error codes
Malicious code in @biz44/id10-client (npm)
Malicious code in @biz44/id10-client (npm)
Malicious code in @biz44/id12-client (npm)
Malicious code in @biz44/id12-client (npm)
Malicious code in @biz44/id99-client (npm)
Malicious code in @biz44/id99-client (npm)
Malicious code in id79-client (npm)
Malicious code in id79-client (npm)
Malicious code in @biz44/id79-client (npm)
Malicious code in @biz44/id79-client (npm)
Malicious code in @biz44/id44-client (npm)
Malicious code in @biz44/id44-client (npm)
Malicious code in @biz44/id95-client (npm)
Malicious code in @biz44/id95-client (npm)
Malicious code in tailwind-form-kit (npm)
Malicious code in tailwind-form-kit (npm)
Malicious code in greensaver (npm)
Malicious code in greensaver (npm)
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
yayson: Prototype pollution in Store/LegacyStore deserialization
yayson: Prototype pollution in Store/LegacyStore deserialization
Malicious code in strapi-plugin-vinsoc-1109 (npm)
Malicious code in strapi-plugin-vinsoc-1109 (npm)
Malicious code in @nimbusedge/auth (npm)
Malicious code in @nimbusedge/auth (npm)
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
Malicious code in tracker-cloudflare (npm)
Malicious code in tracker-cloudflare (npm)
Malicious code in cr-bot-common (npm)
Malicious code in cr-bot-common (npm)
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
Malicious code in etoro-aggregator (npm)
Malicious code in etoro-aggregator (npm)
Malicious code in etoro-analytics (npm)
Malicious code in etoro-analytics (npm)
Malicious code in etoro-core (npm)
Malicious code in etoro-core (npm)
Malicious code in etoro-client (npm)
Malicious code in etoro-client (npm)
Malicious code in etoro-api (npm)
Malicious code in etoro-api (npm)
Malicious code in etoro-cashout (npm)
Malicious code in etoro-cashout (npm)
Malicious code in etoro-auth (npm)
Malicious code in etoro-auth (npm)
Malicious code in etoro-charts (npm)
Malicious code in etoro-charts (npm)
Malicious code in etoro-billing (npm)
Malicious code in etoro-billing (npm)
Malicious code in etoro-builders (npm)
Malicious code in etoro-builders (npm)
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter
n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter
n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
Malicious code in tailwindcss-contact-forms (npm)
Malicious code in tailwindcss-contact-forms (npm)
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
Malicious code in pinochiomathm (npm)
Malicious code in pinochiomathm (npm)
@argos-ci/core: CI Branch Name OS Command Injection
@argos-ci/core: CI Branch Name OS Command Injection
n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Malicious code in @yongot/canary-mcp-test (npm)
Malicious code in @yongot/canary-mcp-test (npm)
Malicious code in express-session-timer (npm)
Malicious code in express-session-timer (npm)
Malicious code in external_deps_enjoyer (npm)
Malicious code in external_deps_enjoyer (npm)
Malicious code in easypanel-hosting (npm)
Malicious code in easypanel-hosting (npm)
Malicious code in easypanel-agent (npm)
Malicious code in easypanel-agent (npm)
Malicious code in @fyxzpediaa/baileys (npm)
Malicious code in @fyxzpediaa/baileys (npm)
Malicious code in cat-sis2go-utils (npm)
Malicious code in cat-sis2go-utils (npm)
Malicious code in easypanel-api-client (npm)
Malicious code in easypanel-api-client (npm)
Malicious code in reactlogo-load (npm)
Malicious code in reactlogo-load (npm)
Malicious code in @auction-fe/reporting-system (npm)
Malicious code in @auction-fe/reporting-system (npm)
Malicious code in easypanel-deploy (npm)
Malicious code in easypanel-deploy (npm)
Malicious code in bx-ui-view (npm)
Malicious code in bx-ui-view (npm)
Malicious code in rojo-rbx (npm)
Malicious code in rojo-rbx (npm)
Malicious code in gloggo (npm)
Malicious code in gloggo (npm)
Malicious code in alloy-graphql (npm)
Malicious code in alloy-graphql (npm)
Malicious code in @yongot/canary-mcp-isolation (npm)
Malicious code in @yongot/canary-mcp-isolation (npm)
Malicious code in sonmors (npm)
Malicious code in sonmors (npm)
Malicious code in file-type-detector (npm)
Malicious code in file-type-detector (npm)
Malicious code in amprem-activator (npm)
Malicious code in amprem-activator (npm)
Malicious code in @haimiya/baileys (npm)
Malicious code in @haimiya/baileys (npm)
Malicious code in @sahril2nd/baileys (npm)
Malicious code in @sahril2nd/baileys (npm)
Malicious code in soltinel-pro (npm)
Malicious code in soltinel-pro (npm)
Malicious code in sams-text-style (npm)
Malicious code in sams-text-style (npm)
Malicious code in selfcerts (npm)
Malicious code in selfcerts (npm)
Malicious code in @umschool/platform (npm)
Malicious code in @umschool/platform (npm)
Malicious code in graphql-js-client-transform (npm)
Malicious code in graphql-js-client-transform (npm)
Malicious code in twilio-hackerone-poc-b8f21a (npm)
Malicious code in twilio-hackerone-poc-b8f21a (npm)
Malicious code in @versacode/baileys (npm)
Malicious code in @versacode/baileys (npm)
Malicious code in cache-cleanup-module (npm)
Malicious code in cache-cleanup-module (npm)
Malicious code in mfaby (npm)
Malicious code in mfaby (npm)
Malicious code in vinnleys (npm)
Malicious code in vinnleys (npm)
Malicious code in crypto-validates (npm)
Malicious code in crypto-validates (npm)
Malicious code in raydium-clmm-sdk (npm)
Malicious code in raydium-clmm-sdk (npm)
Malicious code in polygon-toolkits-validator (npm)
Malicious code in polygon-toolkits-validator (npm)
Malicious code in pumpswap-sdk-v1 (npm)
Malicious code in pumpswap-sdk-v1 (npm)
Malicious code in @neroxkira/vangal-baileys (npm)
Malicious code in @neroxkira/vangal-baileys (npm)
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
Malicious code in discord-mfa-solver (npm)
Malicious code in discord-mfa-solver (npm)
Malicious code in @nexustechpro/baileys (npm)
Malicious code in @nexustechpro/baileys (npm)
Malicious code in @auction-fe/ui-kit (npm)
Malicious code in @auction-fe/ui-kit (npm)
Malicious code in @convertics/script (npm)
Malicious code in @convertics/script (npm)
@openhop/server: Path Traversal in Flow ID File Operations
@openhop/server: Path Traversal in Flow ID File Operations
Malicious code in @auction-fe/portal (npm)
Malicious code in @auction-fe/portal (npm)
Malicious code in xbailsync (npm)
Malicious code in xbailsync (npm)
Malicious code in @auction-fe/base (npm)
Malicious code in @auction-fe/base (npm)
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
Malicious code in gmgn-trading-kit (npm)
Malicious code in gmgn-trading-kit (npm)
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
Malicious code in @vallensofficial/baileys (npm)
Malicious code in @vallensofficial/baileys (npm)
Malicious code in mfatest2 (npm)
Malicious code in mfatest2 (npm)
Malicious code in matrixkit-js (npm)
Malicious code in matrixkit-js (npm)
smol-toml: Denial of Service via malformed TOML documents
smol-toml: Denial of Service via malformed TOML documents
Malicious code in server-authorized-cleanup (npm)
Malicious code in server-authorized-cleanup (npm)
Malicious code in sams-run-style (npm)
Malicious code in sams-run-style (npm)
Malicious code in @vnxsync/libsignal-node (npm)
Malicious code in @vnxsync/libsignal-node (npm)
Malicious code in @staticj/cropperxmjs (npm)
Malicious code in @staticj/cropperxmjs (npm)
Malicious code in chai-as-sleek (npm)
Malicious code in chai-as-sleek (npm)
Malicious code in i18nexus-tools (npm)
Malicious code in i18nexus-tools (npm)
Malicious code in punypump (npm)
Malicious code in punypump (npm)
Malicious code in vinzz-wcli (npm)
Malicious code in vinzz-wcli (npm)
Malicious code in toru-ultimate (npm)
Malicious code in toru-ultimate (npm)
Malicious code in tailwind-aspect-styles (npm)
Malicious code in tailwind-aspect-styles (npm)
Malicious code in @umschool/analytics (npm)
Malicious code in @umschool/analytics (npm)
multer vulnerable to file size limit bypass via async fileFilter race condition
multer vulnerable to file size limit bypass via async fileFilter race condition
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Astro: Remote code execution through AVIF image optimization
Astro: Remote code execution through AVIF image optimization
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
multer vulnerable to Denial of Service via oversized array index in field names
multer vulnerable to Denial of Service via oversized array index in field names
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
morgan vulnerable to Log Forging via unescaped Unicode line separators
morgan vulnerable to Log Forging via unescaped Unicode line separators
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
SVGO: removeScripts allows executable links through namespace and control-character bypasses
SVGO: removeScripts allows executable links through namespace and control-character bypasses
multer vulnerable to Denial of Service via crafted multipart field names
multer vulnerable to Denial of Service via crafted multipart field names
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
xmldom: Quadratic-memory consumption
xmldom: Quadratic-memory consumption
xmldom: Quadratic-time attribute deduplication
xmldom: Quadratic-time attribute deduplication
xmldom: DocType `name` Injection Bypasses requireWellFormed
xmldom: DocType `name` Injection Bypasses requireWellFormed
Malicious code in @aspect-adv-ui/consent-manager (npm)
Malicious code in @aspect-adv-ui/consent-manager (npm)
Colord: Slow rejection of oversized malformed color strings
Colord: Slow rejection of oversized malformed color strings
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
joi: Prototype pollution via a `__proto__` language key in custom messages
joi: Prototype pollution via a `__proto__` language key in custom messages
joi: object().rename() with a template target can set the validated object's prototype
joi: object().rename() with a template target can set the validated object's prototype
xmldom: Element name injection via createElement() bypasses requireWellFormed
xmldom: Element name injection via createElement() bypasses requireWellFormed
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
Malicious code in tailwindcss-aspectratio-styles (npm)
Malicious code in tailwindcss-aspectratio-styles (npm)
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Malicious code in @web2apk/baileys (npm)
Malicious code in @web2apk/baileys (npm)
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
Malicious code in @usemosaik/template-react-js (npm)
Malicious code in @usemosaik/template-react-js (npm)
node-csv: Prototype replacement still reachable via columns path
node-csv: Prototype replacement still reachable via columns path
LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
SWC HTML minifier may allow script element breakout when minifying embedded JSON
SWC HTML minifier may allow script element breakout when minifying embedded JSON
Malicious code in krdpass-auth-react-native (npm)
Malicious code in krdpass-auth-react-native (npm)
Malicious code in i18nexus (npm)
Malicious code in i18nexus (npm)
Malicious code in open-item-validator (npm)
Malicious code in open-item-validator (npm)
@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
Malicious code in plogme (npm)
Malicious code in plogme (npm)
Malicious code in op-ts-server-core (npm)
Malicious code in op-ts-server-core (npm)
Malicious code in redis-type-intel (npm)
Malicious code in redis-type-intel (npm)
Malicious code in service-home (npm)
Malicious code in service-home (npm)
Malicious code in kiki-baileys (npm)
Malicious code in kiki-baileys (npm)
Malicious code in oscar-redis (npm)
Malicious code in oscar-redis (npm)
Malicious code in feishu-docx-mcp (npm)
Malicious code in feishu-docx-mcp (npm)
Malicious code in blueai-cli (npm)
Malicious code in blueai-cli (npm)
Malicious code in b2b-frontend-external-library (npm)
Malicious code in b2b-frontend-external-library (npm)
Malicious code in bmc-i18n-extract-cli (npm)
Malicious code in bmc-i18n-extract-cli (npm)
Malicious code in bmc-translate-utils (npm)
Malicious code in bmc-translate-utils (npm)
Malicious code in omni-channel-configurator-wireline-frontend (npm)
Malicious code in omni-channel-configurator-wireline-frontend (npm)
Malicious code in @caliperx2/components (npm)
Malicious code in @caliperx2/components (npm)
Malicious code in cb-wallet-env (npm)
Malicious code in cb-wallet-env (npm)
Malicious code in scw-core (npm)
Malicious code in scw-core (npm)
Malicious code in cb-wallet-analytics (npm)
Malicious code in cb-wallet-analytics (npm)
Malicious code in wallet-engine-signing (npm)
Malicious code in wallet-engine-signing (npm)
Malicious code in wallet-cds-web (npm)
Malicious code in wallet-cds-web (npm)
Malicious code in scw-mobile (npm)
Malicious code in scw-mobile (npm)
Malicious code in base-account-core (npm)
Malicious code in base-account-core (npm)
Malicious code in cb-wallet-metadata (npm)
Malicious code in cb-wallet-metadata (npm)
Malicious code in cb-wallet-store (npm)
Malicious code in cb-wallet-store (npm)
Malicious code in @aircanada/components (npm)
Malicious code in @aircanada/components (npm)
Malicious code in @aircanada/core (npm)
Malicious code in @aircanada/core (npm)
Malicious code in @aircanada/navigation-handler (npm)
Malicious code in @aircanada/navigation-handler (npm)
Malicious code in cb-wallet-solana-provider (npm)
Malicious code in cb-wallet-solana-provider (npm)
Malicious code in base-app-data (npm)
Malicious code in base-app-data (npm)
Malicious code in @cp-shared-14/frontend-ui (npm)
Malicious code in @cp-shared-14/frontend-ui (npm)
Malicious code in @idkruan-10/dpd-depconf-probe (npm)
Malicious code in @idkruan-10/dpd-depconf-probe (npm)
Malicious code in @liuliang520500/sinataoke_cn (npm)
Malicious code in @liuliang520500/sinataoke_cn (npm)
Malicious code in array-frames (npm)
Malicious code in array-frames (npm)
Malicious code in dcftunnel (npm)
Malicious code in dcftunnel (npm)
Malicious code in omni-channel-oid-frontend (npm)
Malicious code in omni-channel-oid-frontend (npm)
Malicious code in oce-configurator-wireless-frontend (npm)
Malicious code in oce-configurator-wireless-frontend (npm)
Malicious code in ocfe-tv-subscription-center-web (npm)
Malicious code in ocfe-tv-subscription-center-web (npm)
Malicious code in 1cattunnel (npm)
Malicious code in 1cattunnel (npm)
Malicious code in vishal_312pkg (npm)
Malicious code in vishal_312pkg (npm)
Malicious code in multicore-kit (npm)
Malicious code in multicore-kit (npm)
Malicious code in omni-channel-order-frontend (npm)
Malicious code in omni-channel-order-frontend (npm)
Malicious code in date-fns-formatter (npm)
Malicious code in date-fns-formatter (npm)
Malicious code in node-helper (npm)
Malicious code in node-helper (npm)
Malicious code in @liuliang520500/pdd-sdk-new (npm)
Malicious code in @liuliang520500/pdd-sdk-new (npm)
Malicious code in agentrc-security-poc-policy (npm)
Malicious code in agentrc-security-poc-policy (npm)
Malicious code in @pilllesss/yorn (npm)
Malicious code in @pilllesss/yorn (npm)
Malicious code in @liuliang520500/jd-sdk (npm)
Malicious code in @liuliang520500/jd-sdk (npm)
Malicious code in @liuliang520500/pdd-sdk (npm)
Malicious code in @liuliang520500/pdd-sdk (npm)
Malicious code in @liuliang520500/sinataoke_cn_test (npm)
Malicious code in @liuliang520500/sinataoke_cn_test (npm)
Malicious code in @liuliang520500/taobao-topclient (npm)
Malicious code in @liuliang520500/taobao-topclient (npm)
Malicious code in google-img-scrap (npm)
Malicious code in google-img-scrap (npm)
Malicious code in jimg (npm)
Malicious code in jimg (npm)
Malicious code in array-scala (npm)
Malicious code in array-scala (npm)
Malicious code in puppeteer-obscura (npm)
Malicious code in puppeteer-obscura (npm)
Malicious code in eth-lib-helpers (npm)
Malicious code in eth-lib-helpers (npm)
Malicious code in jwt-logger (npm)
Malicious code in jwt-logger (npm)
Malicious code in eth-query-utils (npm)
Malicious code in eth-query-utils (npm)
Malicious code in gas-price-checker (npm)
Malicious code in gas-price-checker (npm)
Malicious code in card3d (npm)
Malicious code in card3d (npm)
Malicious code in btn-particles (npm)
Malicious code in btn-particles (npm)
Malicious code in @domyjs/reactive (npm)
Malicious code in @domyjs/reactive (npm)
Malicious code in tempjs-template (npm)
Malicious code in tempjs-template (npm)
Malicious code in trading-bot-utils (npm)
Malicious code in trading-bot-utils (npm)
Malicious code in linkpreview-simple (npm)
Malicious code in linkpreview-simple (npm)
Malicious code in muswish (npm)
Malicious code in muswish (npm)
Malicious code in pipipe (npm)
Malicious code in pipipe (npm)
Malicious code in infinity-grid (npm)
Malicious code in infinity-grid (npm)
Malicious code in parallaxy-img (npm)
Malicious code in parallaxy-img (npm)
Malicious code in onetime-rnd (npm)
Malicious code in onetime-rnd (npm)
Malicious code in memov (npm)
Malicious code in memov (npm)
Malicious code in @yoannchb/tokenize (npm)
Malicious code in @yoannchb/tokenize (npm)
Malicious code in @domyjs/collapse (npm)
Malicious code in @domyjs/collapse (npm)
Malicious code in lazy-attr (npm)
Malicious code in lazy-attr (npm)
Malicious code in @domyjs/throttle (npm)
Malicious code in @domyjs/throttle (npm)
Malicious code in enqueu (npm)
Malicious code in enqueu (npm)
Malicious code in chrome-speech-recognition (npm)
Malicious code in chrome-speech-recognition (npm)
Malicious code in anime-vostfr (npm)
Malicious code in anime-vostfr (npm)
Malicious code in @yoannchb/langy (npm)
Malicious code in @yoannchb/langy (npm)
Malicious code in @domyjs/anchor (npm)
Malicious code in @domyjs/anchor (npm)
Malicious code in discord-phub (npm)
Malicious code in discord-phub (npm)
Malicious code in @domyjs/intersect (npm)
Malicious code in @domyjs/intersect (npm)
Malicious code in @yoannchb/cattract (npm)
Malicious code in @yoannchb/cattract (npm)
Malicious code in @domyjs/debounce (npm)
Malicious code in @domyjs/debounce (npm)
Malicious code in fast-html-dom-parser (npm)
Malicious code in fast-html-dom-parser (npm)
Malicious code in discord-tqr (npm)
Malicious code in discord-tqr (npm)
Malicious code in iframe-to-video (npm)
Malicious code in iframe-to-video (npm)
Malicious code in inner-svg-ts (npm)
Malicious code in inner-svg-ts (npm)
Malicious code in json-into-html (npm)
Malicious code in json-into-html (npm)
Malicious code in @domyjs/domy (npm)
Malicious code in @domyjs/domy (npm)
Malicious code in ens-namehash-utils (npm)
Malicious code in ens-namehash-utils (npm)
Malicious code in @domyjs/mask (npm)
Malicious code in @domyjs/mask (npm)
Malicious code in @domyjs/router (npm)
Malicious code in @domyjs/router (npm)
Malicious code in @yoannchb/wtf-json (npm)
Malicious code in @yoannchb/wtf-json (npm)
Malicious code in drive-album (npm)
Malicious code in drive-album (npm)
Malicious code in @domyjs/i18n (npm)
Malicious code in @domyjs/i18n (npm)
Malicious code in ulid-intel (npm)
Malicious code in ulid-intel (npm)
Malicious code in orbitron-tui (npm)
Malicious code in orbitron-tui (npm)
Malicious code in tiny-folder-tree (npm)
Malicious code in tiny-folder-tree (npm)
Malicious code in real-router-telemetry (npm)
Malicious code in real-router-telemetry (npm)
Malicious code in tailwind-container-queries (npm)
Malicious code in tailwind-container-queries (npm)
Malicious code in net-util-y8 (npm)
Malicious code in net-util-y8 (npm)
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
Malicious code in line-through (npm)
Malicious code in line-through (npm)
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
Malicious code in @bx-ui-framework/authentication (npm)
Malicious code in @bx-ui-framework/authentication (npm)
Malicious code in box-sign-client-poc (npm)
Malicious code in box-sign-client-poc (npm)
Malicious code in claude-channel-discord (npm)
Malicious code in claude-channel-discord (npm)
Malicious code in box-sign-client (npm)
Malicious code in box-sign-client (npm)
Malicious code in easypanel-app (npm)
Malicious code in easypanel-app (npm)
Malicious code in 2nestjs (npm)
Malicious code in 2nestjs (npm)
Malicious code in tailwindcss-animate-styles (npm)
Malicious code in tailwindcss-animate-styles (npm)
Malicious code in text-transform-plus (npm)
Malicious code in text-transform-plus (npm)
Malicious code in taskforge-9xv (npm)
Malicious code in taskforge-9xv (npm)
Malicious code in easypanel-core (npm)
Malicious code in easypanel-core (npm)
Malicious code in taskforge-8xv (npm)
Malicious code in taskforge-8xv (npm)
Malicious code in tailwind-scrollbar-styles (npm)
Malicious code in tailwind-scrollbar-styles (npm)
Malicious code in easypanel-client (npm)
Malicious code in easypanel-client (npm)
Malicious code in tailwind-aspect (npm)
Malicious code in tailwind-aspect (npm)
Malicious code in hydration-ui-pkg (npm)
Malicious code in hydration-ui-pkg (npm)
Malicious code in xcryption (npm)
Malicious code in xcryption (npm)
Malicious code in tailwindcss-3d-styles (npm)
Malicious code in tailwindcss-3d-styles (npm)
Malicious code in easypanel-docker (npm)
Malicious code in easypanel-docker (npm)
Malicious code in mcp-consultasdeveiculos-client (npm)
Malicious code in mcp-consultasdeveiculos-client (npm)
Malicious code in vitest-cli-dev (npm)
Malicious code in vitest-cli-dev (npm)
Malicious code in peertube-plugin-video-views-counter (npm)
Malicious code in peertube-plugin-video-views-counter (npm)
Malicious code in easypanel-ctl (npm)
Malicious code in easypanel-ctl (npm)
Malicious code in @bx-ui-framework/common (npm)
Malicious code in @bx-ui-framework/common (npm)
Malicious code in @bx-ui-framework/microfrontend (npm)
Malicious code in @bx-ui-framework/microfrontend (npm)
Malicious code in wallet-watcher (npm)
Malicious code in wallet-watcher (npm)
Malicious code in @crysnovax/baileys-fixed (npm)
Malicious code in @crysnovax/baileys-fixed (npm)
Malicious code in @crysnovax/baileys-stable (npm)
Malicious code in @crysnovax/baileys-stable (npm)
Malicious code in @crysnovax/plug (npm)
Malicious code in @crysnovax/plug (npm)
Malicious code in agent-free (npm)
Malicious code in agent-free (npm)
Malicious code in orbitron-cli (npm)
Malicious code in orbitron-cli (npm)
Malicious code in prime-coding-agent (npm)
Malicious code in prime-coding-agent (npm)
Malicious code in tailwind-contact-forms (npm)
Malicious code in tailwind-contact-forms (npm)
Malicious code in megan-baileys (npm)
Malicious code in megan-baileys (npm)
Malicious code in google-cloud-internal-build-helper (npm)
Malicious code in google-cloud-internal-build-helper (npm)
Malicious code in google-cloud-internal-core-utils (npm)
Malicious code in google-cloud-internal-core-utils (npm)
Malicious code in frank-apple-sync-service (npm)
Malicious code in frank-apple-sync-service (npm)
Malicious code in frank-apple-utils (npm)
Malicious code in frank-apple-utils (npm)
Malicious code in google-cloud-mono-repo-helper (npm)
Malicious code in google-cloud-mono-repo-helper (npm)
Malicious code in google-internal-cloud-audit-security-check (npm)
Malicious code in google-internal-cloud-audit-security-check (npm)
Malicious code in apple-cktool-internal-api-v9 (npm)
Malicious code in apple-cktool-internal-api-v9 (npm)
Malicious code in apple-internal-test-utility (npm)
Malicious code in apple-internal-test-utility (npm)
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
Malicious code in btree-range-store (npm)
Malicious code in btree-range-store (npm)
Malicious code in element-utils-guci (npm)
Malicious code in element-utils-guci (npm)
Malicious code in btree-time-index (npm)
Malicious code in btree-time-index (npm)
Malicious code in ordered-kv-index (npm)
Malicious code in ordered-kv-index (npm)
Malicious code in sliding-score-window (npm)
Malicious code in sliding-score-window (npm)
Malicious code in @a23842/dsh-notifier (npm)
Malicious code in @a23842/dsh-notifier (npm)
Malicious code in neighbor-key-map (npm)
Malicious code in neighbor-key-map (npm)
Malicious code in btree-core (npm)
Malicious code in btree-core (npm)
Malicious code in priority-slot-queue (npm)
Malicious code in priority-slot-queue (npm)
Malicious code in dsh-waste-market (npm)
Malicious code in dsh-waste-market (npm)
Malicious code in btree-leaderboard (npm)
Malicious code in btree-leaderboard (npm)
Malicious code in indexed-btree (npm)
Malicious code in indexed-btree (npm)
Malicious code in btree-lru-cache (npm)
Malicious code in btree-lru-cache (npm)
Malicious code in cbc97b7a (npm)
Malicious code in cbc97b7a (npm)
Malicious code in @modss/baileys (npm)
Malicious code in @modss/baileys (npm)
Malicious code in 1nestjs (npm)
Malicious code in 1nestjs (npm)
Malicious code in guci-date (npm)
Malicious code in guci-date (npm)
Malicious code in html_vue (npm)
Malicious code in html_vue (npm)
Malicious code in fullcalendar-windos (npm)
Malicious code in fullcalendar-windos (npm)
Malicious code in guci-main (npm)
Malicious code in guci-main (npm)
Malicious code in ordered-freq-counter (npm)
Malicious code in ordered-freq-counter (npm)
Malicious code in element-icon-guci (npm)
Malicious code in element-icon-guci (npm)
Malicious code in guci-wxrout (npm)
Malicious code in guci-wxrout (npm)
Malicious code in element-guci-util (npm)
Malicious code in element-guci-util (npm)
Malicious code in vscode-vue (npm)
Malicious code in vscode-vue (npm)
Malicious code in 0nestjs (npm)
Malicious code in 0nestjs (npm)
Malicious code in fieldbase-webapplication-buildtools (npm)
Malicious code in fieldbase-webapplication-buildtools (npm)
Malicious code in @avigilon/node-webrtc (npm)
Malicious code in @avigilon/node-webrtc (npm)
Malicious code in @crysnovax/baileys (npm)
Malicious code in @crysnovax/baileys (npm)
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Orval: Import-time RCE via array-items default -> zod module-level template literal
Orval: Import-time RCE via array-items default -> zod module-level template literal
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Orval: Import-time RCE via schema default -> zod module-level template literal
Orval: Import-time RCE via schema default -> zod module-level template literal
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements
node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements
Malicious code in cminhouse-api-gateway-nodejs (npm)
Malicious code in cminhouse-api-gateway-nodejs (npm)
Malicious code in peertube-plugin-poc-marker (npm)
Malicious code in peertube-plugin-poc-marker (npm)
Malicious code in vitest-cli-pro (npm)
Malicious code in vitest-cli-pro (npm)
Malicious code in eslint-rxjs (npm)
Malicious code in eslint-rxjs (npm)
Plate: SSRF with response disclosure in DOCX image embedding
Plate: SSRF with response disclosure in DOCX image embedding
Malicious code in tailwindcss-fluid-styles (npm)
Malicious code in tailwindcss-fluid-styles (npm)
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
Malicious code in real-router-utils (npm)
Malicious code in real-router-utils (npm)
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
Faker: helpers.fake exploitable into arbritary code execution
Faker: helpers.fake exploitable into arbritary code execution
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
qs: Denial of Service via Attacker Controlled isBuffer
qs: Denial of Service via Attacker Controlled isBuffer
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Malicious code in eyiouss (npm)
Malicious code in eyiouss (npm)
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Malicious code in tailwind-theme-engine (npm)
Malicious code in tailwind-theme-engine (npm)
Malicious code in @stellarshift/evm-address-kit (npm)
Malicious code in @stellarshift/evm-address-kit (npm)
Malicious code in onceaction (npm)
Malicious code in onceaction (npm)
Malicious code in is-generator-check (npm)
Malicious code in is-generator-check (npm)
Malicious code in daisypick (npm)
Malicious code in daisypick (npm)
Malicious code in @stellarshift/chain-metadata (npm)
Malicious code in @stellarshift/chain-metadata (npm)
Malicious code in @stellarshift/token-units (npm)
Malicious code in @stellarshift/token-units (npm)
Malicious code in chromatitle-dev (npm)
Malicious code in chromatitle-dev (npm)
Malicious code in @stellarshift/abi-tools (npm)
Malicious code in @stellarshift/abi-tools (npm)
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree
qs array-limit bypass via bracket-key comma parsing
qs array-limit bypass via bracket-key comma parsing
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
Malicious code in order-package-saas (npm)
Malicious code in order-package-saas (npm)
nanoid: Integer Overflow or Wraparound
nanoid: Integer Overflow or Wraparound
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
Malicious code in @yane88/term-reqable-01 (npm)
Malicious code in @yane88/term-reqable-01 (npm)
Malicious code in randomunblockedwebsite (npm)
Malicious code in randomunblockedwebsite (npm)
Malicious code in matrix-by-lmx (npm)
Malicious code in matrix-by-lmx (npm)
Malicious code in @yane88/hexhub-client (npm)
Malicious code in @yane88/hexhub-client (npm)
Malicious code in @yane88/idea-2026.2-04 (npm)
Malicious code in @yane88/idea-2026.2-04 (npm)
Malicious code in @yane88/idea-2026.2-03 (npm)
Malicious code in @yane88/idea-2026.2-03 (npm)
Malicious code in @yane88/idea-2026.2-02 (npm)
Malicious code in @yane88/idea-2026.2-02 (npm)
Malicious code in @yane88/term-reqable (npm)
Malicious code in @yane88/term-reqable (npm)
Malicious code in @yane88/workbuddy-03 (npm)
Malicious code in @yane88/workbuddy-03 (npm)
Malicious code in @yane88/idea-2026.2-06 (npm)
Malicious code in @yane88/idea-2026.2-06 (npm)
Malicious code in @yane88/ripgrep-win (npm)
Malicious code in @yane88/ripgrep-win (npm)
Tooling for npm
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.