aswin1906/github-advisory-2020.csv huggingface dataset:
Malicious Package in jquery-airload
Advisory: GHSA-78p3-96hc-3j47 ()
Published: 2020-09-03T19:11:17Z

Version 0.2.5 of `jquery-airload` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.2.4

Affected packages:
package: ecosystem: npm, name: jquery-airload, versions: 0.2.5
Malicious Package in vue-backbone
Advisory: GHSA-5635-9mvj-r6hp ()
Published: 2020-09-03T02:34:39Z

Version 0.1.2 of `vue-backbone` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: vue-backbone, ranges: type: ECOSYSTEM, events: introduced: 0.1.2
fixed: 0.1.3, versions: 0.1.2
Heap buffer overflow in Tensorflow
Advisory: GHSA-p5f8-gfw5-33w4 (CVE-2020-15201)
Published: 2020-09-25T18:28:34Z

### Impact
The `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the `splits` tensor generate a valid partitioning of the `values` tensor. Hence, this code is prone to heap buffer overflow:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L248-L251

If `split_values` does not end with a value at least `num_values` then the `while` loop condition will trigger a read outside of the bounds of `split_values` once `batch_idx` grows too large. 

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Malicious Package in diamond-clien
Advisory: GHSA-86gv-xpwv-jprc ()
Published: 2020-09-03T17:36:00Z

All versions of `diamond-clien` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: diamond-clien, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Path Traversal in f-serv
Advisory: GHSA-vx5w-cxch-wwc9 ()
Published: 2020-09-03T19:02:27Z

All versions of `f-serv` are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. 


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: f-serv, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in tencent-server
Advisory: GHSA-rr77-w4w8-w8wp (CVE-2017-16216)
Published: 2020-09-01T17:37:46Z

Affected versions of `tencent-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: tencent-server, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Use-After-Free in puppeteer
Advisory: GHSA-c2gp-86p4-5935 (CVE-2019-5786)
Published: 2020-09-02T18:25:43Z

Versions of `puppeteer` prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution.


## Recommendation

Upgrade to version 1.13.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: puppeteer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.13.0
Cross-Site Scripting in swagger-ui
Advisory: GHSA-p239-93f7-h6xf (CVE-2016-5682)
Published: 2020-09-01T15:30:58Z

Affected versions of `swagger-ui` contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document.


## Proof of Concept
The vulnerable object structure is:
```
{
    "definitions": {
        "arbitraryVal": {
            "properties": {
                "<INJECTABLE_KEY_NAME>": "LoremIpsum"
                }
            }
        }
}
```
Malicious JSON documents can be loaded in by providing a URL to them in the `url` query string parameter.



## Recommendation

Update to version 2.2.1 or later.

Affected packages:
package: ecosystem: npm, name: swagger-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.1, database_specific: last_known_affected_version_range: <= 2.2.0
Directory Traversal in serverhuwenhui
Advisory: GHSA-rx32-c25r-79mx (CVE-2017-16102)
Published: 2020-09-01T16:54:41Z

Affected versions of `serverhuwenhui` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: serverhuwenhui, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in ali-contributors
Advisory: GHSA-8m5v-f2wp-wqr9 ()
Published: 2020-09-03T17:30:36Z

All versions of `ali-contributors` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: ali-contributors, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Users with SCRIPT right can execute arbitrary code in XWiki
Advisory: GHSA-7qw5-pqhc-xm4g (CVE-2020-15171)
Published: 2020-09-10T19:19:27Z

### Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution.

### Patches

It has been patched in both version XWiki 12.2.1 and XWiki 11.10.5.

### Workarounds

The only workaround is to give SCRIPT right only to trusted users.

### References

https://jira.xwiki.org/browse/XWIKI-17141
https://jira.xwiki.org/browse/XWIKI-17266

It's been reported by the GitHub Security Lab under #GHSL-2020-046.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.xwiki.platform:xwiki-platform-oldcore, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 11.10.5
package: ecosystem: Maven, name: org.xwiki.platform:xwiki-platform-oldcore, ranges: type: ECOSYSTEM, events: introduced: 12.0.0
fixed: 12.2.1
Denial of Service in @hapi/ammo
Advisory: GHSA-gjph-xf5q-6mfq ()
Published: 2020-09-03T15:46:02Z

Versions of `@hapi/ammo` prior to 3.1.2 or 5.0.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 3.1.2 or 5.0.1.

Affected packages:
package: ecosystem: npm, name: @hapi/ammo, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.2
package: ecosystem: npm, name: @hapi/ammo, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 5.0.1
Undefined Behavior in zencashjs
Advisory: GHSA-xfrc-7mj2-5xh9 ()
Published: 2020-09-03T17:14:51Z

Versions of `zencashjs` prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH or P2SH). Due to the base58 address prefixes chosen in Horizen there exists the possibility of a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses, testnet P2PKH addresses start with “zt” while a subset of mainnet P2SH addresses can also start with “zt”. The package interprets transactions sent to a “zt” P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature address starting with “zt” will be sent to the wrong address and be lost.


## Recommendation

Upgrade to version 1.2.0 or later.

Affected packages:
package: ecosystem: npm, name: zencashjs, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.0
Command Injection in bestzip
Advisory: GHSA-4qqc-mp5f-ccv4 ()
Published: 2020-09-02T15:05:51Z

Versions of `bestzip` prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `zip` function . This may allow attackers to execute arbitrary code in the system as long as the values of `destination` is user-controlled. This only affects users with a native `zip` command available. The following examples demonstrate the issue from the CLI and also programatically:
- `bestzip test.zip 'sourcefile; mkdir folder'`
- `zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })`

Affected packages:
package: ecosystem: npm, name: bestzip, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.1.7
Malicious Package in juffer-xor
Advisory: GHSA-gqq4-937c-2282 ()
Published: 2020-09-03T22:49:42Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: juffer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in markdown-to-jsx
Advisory: GHSA-ccrp-c664-8p4j ()
Published: 2020-09-03T21:17:36Z

Versions of `markdown-to-jsx` prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing `data` or VBScript URIs and a base64-encoded payload.


## Recommendation

Upgrade to version 6.11.4 or later.

Affected packages:
package: ecosystem: npm, name: markdown-to-jsx, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.11.4
Malicious Package in rc-calendar-jhorst
Advisory: GHSA-4c87-gg2q-fc6m ()
Published: 2020-09-01T20:31:04Z

Version 8.4.3 of `rc-calendar-jhorst` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 8.4.3 of this module is found installed you will want to replace it with a version before or after 8.4.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 8.4.2

Affected packages:
package: ecosystem: npm, name: rc-calendar-jhorst, versions: 8.4.3
Command Injection in node-rules
Advisory: GHSA-8whr-v3gm-w8h9 ()
Published: 2020-09-03T15:51:04Z

Versions of `node-rules` prior to 5.0.0 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `eval` call when using the `fromJSON` function. This may allow attackers to execute arbitrary code in the system if the rules are user-controlled.


## Recommendation

Upgrade to version 5.0.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected packages:
package: ecosystem: npm, name: node-rules, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.0.0
Denial of Service in @hapi/subtext
Advisory: GHSA-3wqh-h42r-x8fq ()
Published: 2020-09-03T15:46:22Z

Versions of `@hapi/subtext` prior to 6.1.3 or 7.0.3 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 6.1.3 or 7.0.3

Affected packages:
package: ecosystem: npm, name: @hapi/subtext, ranges: type: ECOSYSTEM, events: introduced: 4.1.0
fixed: 6.1.3
package: ecosystem: npm, name: @hapi/subtext, ranges: type: ECOSYSTEM, events: introduced: 7.0.0
fixed: 7.0.3
Malicious Package in rrgod
Advisory: GHSA-277p-xwpp-3jf7 ()
Published: 2020-09-02T15:49:22Z

All versions of `rrgod` are considered malicious. The package is malware designed to run arbitrary scripts. When installed, the package downloads an arbitrary file and executes its contents as a pre, post and install scripts.


## Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: rrgod, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Symlink reference outside of node_modules in bin-links
Advisory: GHSA-2mj8-pj3j-h362 ()
Published: 2020-09-04T17:17:39Z

Versions of `bin-links` prior to 1.1.5 are vulnerable to a Symlink reference outside of node_modules. It is possible to create symlinks to files outside of the`node_modules` folder through the `bin` field. This may allow attackers to access unauthorized files.


## Recommendation

Upgrade to version 1.1.5 or later.

Affected packages:
package: ecosystem: npm, name: bin-links, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.5
Directory Traversal in pytservce
Advisory: GHSA-jwjq-vp53-ph6m (CVE-2017-16195)
Published: 2020-09-01T18:21:44Z

Affected versions of `pytservce` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: pytservce, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in beffer-xor
Advisory: GHSA-7cvf-p83w-48q6 ()
Published: 2020-09-03T21:37:29Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/
Affected packages:
package: ecosystem: npm, name: beffer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffer-xkr
Advisory: GHSA-rw53-q8x7-ccx8 ()
Published: 2020-09-03T21:55:17Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xkr, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Out-of-bounds Read in njwt
Advisory: GHSA-g3qw-9pgp-xpj4 ()
Published: 2020-09-01T21:08:44Z

Versions of `njwt` prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the `base64urlEncode` function. 

On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability.


## Recommendation

Upgrade to version 1.0.0.

Affected packages:
package: ecosystem: npm, name: njwt, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.0
Malicious Package in another-date-picker
Advisory: GHSA-2p62-c4rm-mr72 ()
Published: 2020-09-01T19:44:57Z

Version 2.0.43 of `another-date-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 2.0.43 of this module is found installed you will want to replace it with a version before or after 2.0.43. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/
Affected packages:
package: ecosystem: npm, name: another-date-picker, ranges: type: ECOSYSTEM, events: introduced: 2.0.43
fixed: 2.0.45, versions: 2.0.43
Cross-Site Scripting in bootstrap-tagsinput
Advisory: GHSA-v2jq-9475-r5g8 (CVE-2016-1000227)
Published: 2020-09-01T15:29:51Z

All versions of `bootstrap-tagsinput` are vulnerable to cross-site scripting when user input is passed into the `itemTitle` parameter unmodified, as the package fails to properly sanitize or encode user input for that parameter.



## Recommendation

This package is not actively maintained, and has not seen an update since 2015. 

Because of this, the simplest mitigation is to avoid using the `itemTitle` parameter. With over 200 open issues and over 100 open pull requests as of 2/2018, it seems unlikely that the author has any intention of maintaining the module. If avoiding the use of `itemTitle` indefinitely is acceptable, this is a workable solution. If not, the best available mitigation is to use a fork of the module that is actively maintained and provides similar functionality. There are [many such forks to choose from available on github.](https://github.com/bootstrap-tagsinput/bootstrap-tagsinput/network/members).

Affected packages:
package: ecosystem: npm, name: bootstrap-tagsinput, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.8.0
Prototype Pollution in lodash.merge
Advisory: GHSA-h726-x36v-rx45 ()
Published: 2020-09-03T18:04:54Z

Versions of `lodash.merge` before 4.6.2 are vulnerable to prototype pollution. The function `merge` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.2 or later.

Affected packages:
package: ecosystem: npm, name: lodash.merge, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.6.2
Malicious Package in axios-http
Advisory: GHSA-r2rg-683g-ff96 ()
Published: 2020-09-03T19:40:12Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: axios-http, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in exprss
Advisory: GHSA-6qc7-jgq7-34rf ()
Published: 2020-09-02T20:18:18Z

All versions of `exprss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: exprss, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in colro-name
Advisory: GHSA-jp9g-5x75-ccp8 ()
Published: 2020-09-02T21:34:30Z

Version 9.0.0 of `colro-name` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: colro-name, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in soket.js
Advisory: GHSA-x6gq-467r-hwcc ()
Published: 2020-09-01T21:14:05Z

All versions of `soket.js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: soket.js, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in bitcoin-sweep
Advisory: GHSA-8hqw-qp6r-vqcm ()
Published: 2020-09-04T16:40:00Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcoin-sweep, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in angular-bmap
Advisory: GHSA-w8hg-mxvh-9h57 ()
Published: 2020-09-01T19:42:49Z

Version 0.0.9 of `angular-bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.9 of this module is found installed you will want to replace it with a version before or after 0.0.9. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: angular-bmap, versions: 0.0.9
SQL Injection in resquel
Advisory: GHSA-crpm-fm48-chj7 ()
Published: 2020-09-11T21:13:44Z

All versions of `resquel` are vulnerable to SQL Injection. Query parameters are not properly sanitized, allowing attackers to inject SQL statements and execute arbitrary SQL queries


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: resquel, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in mogoose
Advisory: GHSA-5mm9-55c9-p5r7 ()
Published: 2020-09-03T19:53:31Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: mogoose, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in ruffer-xor
Advisory: GHSA-2mxc-m4c3-wqhq ()
Published: 2020-09-03T22:50:46Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: ruffer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in cage-js
Advisory: GHSA-jf8x-wg7f-p3w8 ()
Published: 2020-09-03T18:22:33Z

All versions of `cage-js`  contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: cage-js, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffes-xor
Advisory: GHSA-28f4-mjfq-qrvf ()
Published: 2020-09-03T22:18:40Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffes-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bb-builder
Advisory: GHSA-vm6v-w6q2-mrrq ()
Published: 2020-09-03T19:20:05Z

All versions of `bb-builder` contained malicious code. The package ran an executable targeting Windows and uploaded information to a remote server.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bb-builder, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in load-from-cwd-or-npm
Advisory: GHSA-jxf5-7x3j-8j9m ()
Published: 2020-09-03T18:19:14Z

Version 3.0.2 of `load-from-cwd-or-npm`  contains malicious code. The malware breaks functionality of the `purescript-installer` package by injecting targeted code.


## Recommendation

Upgrade to version 3.0.4 or later. There is no indication of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: load-from-cwd-or-npm, ranges: type: ECOSYSTEM, events: introduced: 3.0.2
fixed: 3.0.4, versions: 3.0.2
Malicious Package in only-test-not-install
Advisory: GHSA-g9wf-393q-4w38 ()
Published: 2020-09-03T17:28:26Z

All versions of `only-test-not-install` contain malicious code. The package deletes the folder `~/test` from the system as a postinstall script.


## Recommendation

Remove the package from your environment. There are no further signs of compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: only-test-not-install, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Improper Authorization in @sap-cloud-sdk/core
Advisory: GHSA-r2vw-jgq9-jqx2 ()
Published: 2020-09-03T15:54:11Z

Affected versions of `@sap-cloud-sdk/core` do not properly validate JWTs.  The `verifyJwt()` function does not properly validate the URL from where the public verification key for the JWT can be downloaded.  Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.


## Recommendation

Upgrade to version 1.21.2 or later.

Affected packages:
package: ecosystem: npm, name: @sap-cloud-sdk/core, ranges: type: ECOSYSTEM, events: introduced: 1.19.0
fixed: 1.21.2
Entropy Backdoor in text-qrcode
Advisory: GHSA-h5vj-f7r9-w564 ()
Published: 2020-09-01T21:22:35Z

All versions of `text-qrcode` contain malicious code that overwrites the `randomBytes` method for the `crypto` module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being returned, but one that is easily guessable. 


## Recommendation

Uninstall `text-qrcode` immediately. If the module was used to generate entropy that is load bearing, all such instances of generated entropy must be replaced. This includes things like bitcoin wallets, private keys, encrypted messages, etc.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: text-qrcode, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in uv-tj-demo
Advisory: GHSA-m362-87jc-f39v (CVE-2017-16200)
Published: 2020-09-01T18:16:24Z

Affected versions of `uv-tj-demo` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: uv-tj-demo, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in 4equest
Advisory: GHSA-p33q-w45h-2hcj ()
Published: 2020-09-02T18:30:03Z

All versions of `4equest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: 4equest, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in antd-cloud
Advisory: GHSA-j4vm-hg8g-g9qv ()
Published: 2020-09-03T17:33:50Z

All versions of `antd-cloud` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: antd-cloud, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in appx-compiler
Advisory: GHSA-8q2c-2396-hf7j ()
Published: 2020-09-03T17:34:55Z

All versions of `appx-compiler` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: appx-compiler, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in path-to-regxep
Advisory: GHSA-f7gc-6hcj-wc42 ()
Published: 2020-09-03T17:05:06Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: path-to-regxep, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in my-very-own-package
Advisory: GHSA-crr2-ph72-c52g ()
Published: 2020-09-03T17:27:22Z

All versions of `my-very-own-package` contain malicious code. The package sends the output of `process.versions`, `process.arch` and `process.platform` to a remote server in a postinstall script.


## Recommendation

Remove the package from your environment. There are no further signs of compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: my-very-own-package, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in 11xiaoli
Advisory: GHSA-x2jj-x3q2-7hph (CVE-2017-16160)
Published: 2020-09-01T17:28:09Z

Affected versions of `11xiaoli` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: 11xiaoli, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in css_transform_step
Advisory: GHSA-4rx9-58m7-gr8w ()
Published: 2020-09-01T19:53:40Z

Version 1.0.6 of `css_transform_step` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.6 of this module is found installed you will want to replace it with a version before or after 1.0.6. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.5

Affected packages:
package: ecosystem: npm, name: css_transform_step, versions: 1.0.6
Malicious Package in bitconijs-lib
Advisory: GHSA-74hh-4rcv-pp27 ()
Published: 2020-09-04T16:44:19Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitconijs-lib, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Arbitrary File Write in iobroker.admin
Advisory: GHSA-54xj-q58h-9x57 (CVE-2019-10765)
Published: 2020-09-04T15:24:56Z

Versions of `iobroker.admin` prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in the `/log/` route, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.


## Recommendation

Upgrade to version 3.6.12 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: iobroker.admin, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.6.12
Malicious Package in jasmin
Advisory: GHSA-9cq4-mhmr-84gm ()
Published: 2020-09-01T20:26:49Z

Version 0.0.3 of `jasmin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.3 of this module is found installed you will want to replace it with a version before or after 0.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.0.2

Affected packages:
package: ecosystem: npm, name: jasmin, versions: 0.0.3
Prototype Pollution in lodash.defaultsdeep
Advisory: GHSA-46fh-8fc5-xcwx ()
Published: 2020-09-03T18:09:16Z

Versions of `lodash.defaultsdeep` before 4.6.1 are vulnerable to Prototype Pollution. The function 'defaultsDeep' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.

Affected packages:
package: ecosystem: npm, name: lodash.defaultsdeep, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.6.1
Insecure Cryptography Algorithm in parsel
Advisory: GHSA-wqgx-4q47-j2w5 ()
Published: 2020-09-04T17:36:04Z

All versions of `parsel` use an insecure cryptography algorithm. The package uses `aes-256-cbc` without integrity checks, which renders the ciphertext vulnerable to bit-flipping attacks.


## Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.

Affected packages:
package: ecosystem: npm, name: parsel, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buvfer-xor
Advisory: GHSA-wjpj-gmc3-5w56 ()
Published: 2020-09-03T22:30:31Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buvfer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bitcoisnj-lib
Advisory: GHSA-629c-j867-3v45 ()
Published: 2020-09-04T16:41:04Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcoisnj-lib, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in cxt
Advisory: GHSA-fpgg-r39h-3x5x ()
Published: 2020-09-03T17:06:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: cxt, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in htmr
Advisory: GHSA-f8rq-m28h-8hxj ()
Published: 2020-09-03T15:50:29Z

Versions of `htmr` prior to 0.8.7 are vulnerable to Cross-Site Scripting (XSS).  The package uses `innerHTML` to unescape HTML entities. This may lead to [DOM-based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS) through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.8.7 or later.

Affected packages:
package: ecosystem: npm, name: htmr, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.8.7
Directory Traversal in serverlyr
Advisory: GHSA-46q2-93hm-52p5 (CVE-2017-16089)
Published: 2020-09-01T16:53:37Z

Affected versions of `serverlyr` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: serverlyr, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in anarchy
Advisory: GHSA-jjhg-qw5v-r8xx ()
Published: 2020-09-03T19:01:20Z

All versions of `anarchy` contain malicious code. The package ran `rm - rf /` as an install script.


## Recommendation

Remove the package from your environment.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: anarchy, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in hexo-admin
Advisory: GHSA-phph-xpj4-wvcv ()
Published: 2020-09-03T21:13:07Z

All versions of `hexo-admin` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a victim's browser if they are able to create new posts.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: hexo-admin, ranges: type: ECOSYSTEM, events: introduced: 0.0.0