Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-16200uv-tj-demo is a static file server.npm · uv-tj-demo
- CVE-2017-16201zjjserver is a static file server.npm · zjjserver
- CVE-2017-16202The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installatnpm · cofeescript
- CVE-2017-16203The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installanpm · coffe-script
- CVE-2017-16204The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.npm · jquey
- CVE-2017-16205The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installatnpm · coffescript
- CVE-2017-16206The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installanpm · cofee-script
- CVE-2017-16207discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.npm · discordi.js
- CVE-2017-16208dmmcquay.lab6 is a REST server.npm · dmmcquay.lab6
- CVE-2017-16209enserver is a simple web server.npm · enserver
- CVE-2017-16210jn_jj_server is a static file server.npm · jn_jj_server
- CVE-2017-16211lessindex is a static file server.npm · lessindex
- CVE-2017-16212ltt is a static file server.npm · ltt
- CVE-2017-16213mfrserver is a simple file server.npm · mfrserver
- CVE-2017-16214peiserver is a static file server.npm · peiserver
- CVE-2017-16215sgqserve is a simple file server.npm · sgqserve
- CVE-2017-16216tencent-server is a simple web server.npm · tencent-server
- CVE-2017-16217fbr-client sends files through sockets via socket.io and webRTC.npm · fbr-client
- CVE-2017-16218dgard8.lab6 is a static file server.npm · dgard8.lab6
- CVE-2017-16219yttivy is a static file server.npm · yttivy
- CVE-2017-16220wind-mvc is an mvc framework.npm · wind-mvc
- CVE-2017-16221yzt is a simple file server.npm · yzt
- CVE-2017-16222elding is a simple web server.npm · elding
- CVE-2017-16223nodeaaaaa is a static file server.npm · nodeaaaaa
- CVE-2017-16224st is a module for serving static files.npm · st · fixed in 1.2.2
- CVE-2017-16225aegir is a module to help automate JavaScript project management.npm · aegir · fixed in 12.0.8
- CVE-2017-16226The static-eval module is intended to evaluate statically-analyzable expressions.npm · static-eval · fixed in 2.0.0
- CVE-2018-3711Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" andnpm · fastify · fixed in 0.38.0
- CVE-2018-3712serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in pathnpm · serve · fixed in 6.4.9
- CVE-2018-3713angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a manpm · angular-http-server · fixed in 1.6.0