Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-10657co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacnpm · co-cli-installer
- CVE-2016-10660fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries.npm · fis-parser-sass-bin
- CVE-2016-10661phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM npm · phantomjs-cheniu
- CVE-2016-10662tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.npm · tomita
- CVE-2016-10663wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerabnpm · wixtoolset
- CVE-2016-10664mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vunpm · mystem
- CVE-2016-10665herbivore is a packet sniffing and crafting library.npm · herbivore
- CVE-2016-10667selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attnpm · selenium-portal
- CVE-2016-10668libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacnpm · libsbml
- CVE-2016-10669soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.npm · soci
- CVE-2016-10670windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it npm · windows-seleniumjar-mirror
- CVE-2016-10671mystem-wrapper is a Yandex mystem app wrapper module.npm · mystem-wrapper
- CVE-2016-10672cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MInpm · cloudpub-redis
- CVE-2016-10673ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITnpm · ipip-coffee
- CVE-2016-10675libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerabnpm · libsbmlsim
- CVE-2016-10676rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable tnpm · rs-brightcove
- CVE-2016-10677google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-npm · google-closure-tools-latest
- CVE-2016-10678serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.npm · serc.js
- CVE-2016-10683arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks.npm · arcanist
- CVE-2016-10684healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vunpm · healthcenter
- CVE-2016-10685pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM npm · pk-app-wonderbox
- CVE-2016-10686fis-sass-all is another libsass wrapper for node.npm · fis-sass-all
- CVE-2016-10687windows-selenium-chromedriver is a module that downloads the Selenium Jar file.npm · windows-selenium-chromedriver
- CVE-2016-10688Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnpm · haxe3
- CVE-2016-10689The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leavenpm · windows-iedriver
- CVE-2016-10690openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim.npm · openframe-ascii-image
- CVE-2016-10691windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves npm · windows-seleniumjar
- CVE-2016-10692haxeshim haxe shim to deal with coexisting versions.npm · haxeshim
- CVE-2016-10693pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable tnpm · pm2-kafka
- CVE-2016-10694alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows.npm · alto-saxophone · fixed in 2.25.1