The npm package 'dowload_ebok_lolita_by_vladimir_nabokov_oy1gy' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone may not fully eliminate the malicious presence due to potential persistent control by an attacker.
The npm package 'dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p' contains malicious code that fully compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package 'dowload_ebok_armageddon_by_max_hastings_kv3s4' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets from a different, uncompromised device is strongly advised. However, removal of the package alone may not fully eliminate the malicious presence due to potential persistence mechanisms.
The npm package 'dependencykfeg' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone may not eliminate all malicious software introduced by its installation, as attackers may have gained full control over the system.
The orderbook-volt-plugin npm package versions 0.0.0-stage, 0.0.1, and 0.0.2 contain malicious code. Any computer with this package installed or running should be considered fully compromised. Secrets and keys stored on the affected system must be rotated immediately from a different, clean machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The react-native-drago-callkit npm package contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to the potential for persistent malicious software, complete remediation may require additional measures such as rotating all secrets and keys from a different, secure computer.
The npm package @chatunitycenter/baileys contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, trusted computer are strongly advised.
The decode-uri-component package has a denial of service vulnerability due to quadratic time complexity when processing malformed inputs with many distinct percent-encoded runs. An attacker can craft a payload of about 224 KB that causes the Node.js event loop to block for approximately 20 seconds, making the application unresponsive. This affects version 0.5.0 and earlier. The issue arises because the fallback decoding function performs multiple regex replacements proportional to the number of distinct encoded runs, leading to O(K·L) complexity. The vulnerability impacts availability only, with no confidentiality or integrity effects. It is fixed in version 0.5.1.
A vulnerability in Vite dev server allows bypassing the server.fs.deny file access restrictions via crafted query parameters. This affects applications that expose the Vite dev server to the network and have sensitive files in allowed directories that are supposed to be denied. The issue was fixed in version 6.4.5.
@eeacms/volto-chatbot version prior to 2.0.4 contains an unauthenticated proxy vulnerability that allows attackers to invoke arbitrary Danswer API operations with server-side credentials. The middleware route '**/_v1_da/**' accepts any HTTP method and path without authentication or path restrictions, forwarding requests with attached API keys or session cookies. This enables a Confused Deputy attack where attackers can perform privileged actions on the upstream Danswer API as the configured service account.
A vulnerability in Cedar JSON policy templates using the 'is in' scope condition allows malformed slot identifiers to cause linking errors or semantic mismatches. This can lead to policy panics or unintended authorization decisions, such as allowing access that should be forbidden. The issue affects only malformed JSON policies with incorrect slot identifiers in principal and resource constraints. Versions prior to 4.11.1 and 3.4.3 are affected. Patches are available in these fixed versions.
The @sylphx/pdf-reader-mcp package, when run as an HTTP server with MCP_TRANSPORT=http, fails to enforce API key authentication despite logging that it does. This allows unauthenticated access to the /mcp endpoint, enabling any client able to reach the server to invoke PDF processing tools and read any accessible PDF files on the host. The default binding to all interfaces (0.0.0.0) increases exposure risk. This vulnerability affects versions >=2.2.0 and <3.0.1 and is fixed in version 3.0.1.
Parse Server versions prior to 9.10.0-alpha.2 and 8.6.84 are vulnerable to a stored cross-site scripting (XSS) issue via malformed Content-Type headers in file uploads. The vulnerability arises because malformed Content-Type values that do not conform to the type/subtype format can bypass the file extension blocklist and be stored unchanged. When served from storage adapters that preserve the Content-Type header (e.g., Amazon S3, Google Cloud Storage, Azure Blob Storage), browsers may MIME-sniff the file content and execute embedded scripts, leading to stored XSS. The default GridFS adapter is not affected due to recomputing Content-Type and using X-Content-Type-Options: nosniff. Patches are available that validate Content-Type headers for well-formedness and reject malformed values.
The npm package '789bet-vip-login' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package '789bet-vip-online-login' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but due to potential full control by an attacker, removal may not eliminate all malicious components. Secrets and keys should be rotated from a separate, uncompromised device.
The npm package '789bet-vip' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys. Immediate removal of the package is recommended, but full remediation may require rotating all secrets and keys from a different, uncompromised system due to potential persistent control by attackers.
The npm package '789bet-login-th' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, clean machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package '789bet-entrance' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have established persistent control.