Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-16077mongose was a malicious module published with the intent to hijack environment variables.npm · mongose
- CVE-2017-16078shadowsock was a malicious module published with the intent to hijack environment variables.npm · shadowsock
- CVE-2017-16079smb was a malicious module published with the intent to hijack environment variables.npm · smb
- CVE-2017-16080nodesass was a malicious module published with the intent to hijack environment variables.npm · nodesass
- CVE-2017-16081cross-env.js was a malicious module published with the intent to hijack environment variables.npm · cross-env.js
- CVE-2017-16082A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column npm · pg · fixed in 2.11.2, 3.6.4, 4.5.7 and more
- CVE-2017-16083node-simple-router is a minimalistic router for Node.npm · node-simple-router · fixed in 0.10.1
- CVE-2017-16084list-n-stream is a server for static files to list and stream local videos.npm · list-n-stream · fixed in 0.0.11
- CVE-2017-16085tinyserver2 is a webserver for static files.npm · tinyserver2 · fixed in 0.6.0
- CVE-2017-16086ua-parser is a port of Browserscope's user agent parser.npm · ua-parser
- CVE-2017-16088The safe-eval module describes itself as a safer version of eval.npm · safe-eval
- CVE-2017-16089serverlyr is a simple http server.npm · serverlyr
- CVE-2017-16090fsk-server is a simple http server.npm · fsk-server
- CVE-2017-16091xtalk helps your browser talk to nodex, a simple web framework.npm · xtalk
- CVE-2017-16092Sencisho is a simple http server for local development.npm · sencisho
- CVE-2017-16093cyber-js is a simple http server.npm · cyber-js
- CVE-2017-16094iter-http is a server for static files.npm · iter-http
- CVE-2017-16095serverliujiayi1 is a simple http server.npm · serverliujiayi1
- CVE-2017-16096serveryaozeyan is a simple HTTP server.npm · serveryaozeyan
- CVE-2017-16097tiny-http is a simple http server.npm · tiny-http
- CVE-2017-16098charset 1.0.0 and below are vulnerable to regular expression denial of service.npm · charset · fixed in 1.0.1
- CVE-2017-16099The no-case module is vulnerable to regular expression denial of service.npm · no-case · fixed in 2.3.2
- CVE-2017-16100dns-sync is a sync/blocking dns resolver.npm · dns-sync · fixed in 0.1.1
- CVE-2017-16101serverwg is a simple http server.npm · serverwg
- CVE-2017-16102serverhuwenhui is a simple http server.npm · serverhuwenhui
- CVE-2017-16103serveryztyzt is a simple http server.npm · serveryztyzt
- CVE-2017-16104citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the urlnpm · citypredict.whauwiller
- CVE-2017-16105serverwzl is a simple http server.npm · serverwzl
- CVE-2017-16106tmock is a static file server.npm · tmock
- CVE-2017-16107pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.npm · pooledwebsocket · fixed in 0.0.19