signalk-server versions from 2.28.0-beta.2 up to but not including 2.34.0 contain a server-side request forgery (SSRF) vulnerability via the app store icon fetcher. The server fetches absolute URLs declared in a plugin's signalk.appIcon field without proper restrictions, allowing an attacker to cause the server to make HTTP requests to internal or cloud metadata endpoints. Responses with image content types are stored and served back to the admin UI. This can be exploited by publishing a malicious plugin to the app store. A fix is available in version 2.34.0.
A path traversal vulnerability in the Signal K server's resources API allows unauthenticated or low-privileged users to read, write, and delete files outside the intended storage directory. This includes reading the security.json file containing the JWT signing secret, enabling attackers to forge admin JWT tokens and gain administrative access. With admin privileges, attackers can create providers that execute arbitrary shell commands, resulting in remote code execution with server privileges. The vulnerability affects all signalk-server versions prior to 2.34.0 and resources-provider versions prior to 1.5.3. The issue is patched in versions 2.34.0 and 1.5.3.
The npm package vas-tops2-reportingui contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package vas-tops2-core-clients-search contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
The npm package vas-tops2-core-client-cleanup-ui contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @tops2/digital-assistant-ui contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package vas-tops2-digital-assistant-ui contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, clean computer. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
The npm package vas-tops2-core-property-search contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removal of the package alone does not guarantee elimination of all malicious software introduced by this package.
The npm package vas-tops2-bidmatrix-ui contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a separate, uncompromised machine. Removing the package alone may not eliminate all malicious software introduced by its installation.
The tefeest-npm-com-test package contains malicious code that can fully compromise any computer on which it is installed or running. It is advised to immediately rotate all secrets and keys from a different, uncompromised machine. Removing the package alone may not eliminate all malicious software introduced by it.
The neuralwhatsapp npm package contains malicious code that compromises any computer on which it is installed or running. Installation of this package results in a full system compromise, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but full remediation may require rotating all secrets from a separate, uncompromised system due to the risk of persistent malicious software.
The npm package 'ourin-baileys' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
The apex-fetch npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The grizzly-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
The npm package 'tabby-fknat' version 0.1.2 contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, complete remediation may require rotating all secrets and keys from a different, trusted machine.
The @nx/maven and @nx/gradle plugins for Nx have an OS command injection vulnerability due to unsafe interpolation of plugin options from nx.json into shell commands. This allows execution of arbitrary commands when running nx commands that construct the project graph. The vulnerability affects specific versions of these plugins and has been fixed in versions 22.7.9 and 23.1.2. Users should upgrade both the nx package and the affected plugins to these versions or later to remediate the issue.
The npm package @nexlayerlabs/postcss-keyframe-utils contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removal of the package alone does not guarantee elimination of the malicious software or attacker control.
The npm package 'claims-acct-unlock' version 25.2.1 has been identified as malicious by the OpenSSF Package Analysis project. It is flagged because it communicates with a domain linked to malicious activity and executes commands associated with malicious behavior. This package poses a security risk to users who install or use it.
The ssite-mock-server npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately using a different, clean computer. Simply removing the package does not guarantee removal of all malicious software introduced by the package.
The npm package '@sxm-content-creators/tools-ds' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not eliminate all malicious software introduced by it, as full control of the computer may have been granted to an attacker.