A vulnerability in the @payloadcms/storage-vercel-blob package allows authenticated users to bypass access control for client uploads in certain versions. This occurs because client upload access does not consistently enforce the collection-level access permissions. The issue affects versions >=3.25.0 <3.90.0 and >=4.0.0-canary.0 <4.0.0-canary.34. A fix is available in versions 3.90.0 and 4.0.0-canary.34, which require authentication and proper collection-level access for uploads.
The npm package @realvare/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone may not eliminate all malicious software, as full control of the computer may have been granted to an attacker.
The npm package '@realvare/based' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control over the system.
The npm package @fyxzpediaa/libsignal is identified as containing malicious code. Any system with this package installed or running is considered fully compromised, with potential unauthorized control by an attacker. Immediate rotation of all secrets and keys stored on the affected system is recommended. Removal of the package alone may not eliminate all malicious components due to possible persistent control established by the attacker.
The odf-kit library versions from 0.6.0 up to but not including 0.14.2 contain an HTML injection vulnerability in the odtToHtml() and odsToHtml() functions. This occurs because style attribute values from ODF documents are inserted into HTML style attributes without proper escaping, allowing an attacker to inject arbitrary HTML and execute scripts (XSS) via crafted .odt or .ods files. The issue affects multiple style attributes and is present in both the ODT and ODS to-HTML renderers. A fix is available in version 0.14.2.
The npm package @ai-ecoverse/slicc-windows-amd64 version 1.46.4 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'screenshot-desktop' version 1.16.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, clean computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package @ifasn/ms-doc-mcp, advertised as a Markdown toolkit, contains malicious code that probes the Alibaba Cloud instance metadata service to harvest temporary IAM credentials and other sensitive instance metadata. This harvested data is output to stdout and a local file, potentially exposing credentials beyond the local host. The behavior is unrelated to the package's declared functionality and poses a risk of credential leakage.
The yzx-npm package versions 1.0.0 and 1.0.1 contain malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control.
The npm package 'mocha-ui-themes' contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but due to the severity of the compromise, simply removing the package may not eliminate all malicious software. Secrets and keys should be rotated from a different, trusted machine.
The tailwind-form-core npm package contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, uncompromised machine. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The npm package react-contact-forms contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The tailwind-input-kit npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'jito-bundle-tip-7' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is recommended, but due to the extent of the compromise, complete remediation may require rotating all secrets and keys from a separate, uncompromised machine.
The jito-bundle-solana npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'jito-bundle-jito-tip7' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package @touchkey0111/jito-bundle contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it, and immediate rotation of all secrets and keys from a different, uncompromised computer is strongly advised.
The jito-bundle-jitotip npm package contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is recommended, but due to the extent of the compromise, full remediation may require rotating all secrets and keys from a separate, uncompromised device.
The npm package 'arbkit' contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is recommended, but due to the extent of the compromise, complete remediation cannot be guaranteed by removal alone.
The npm package 'txnforge' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee full remediation, as the attacker may have established persistent control over the system.