aswin1906/github-advisory-2020.csv huggingface dataset:
Malicious Package in btffer-xor
Advisory: GHSA-8hrq-9wm7-v3jw ()
Published: 2020-09-03T21:39:41Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: btffer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Sandbox Breakout / Arbitrary Code Execution in lighter-vm
Advisory: GHSA-c3hq-7mxh-mqxf ()
Published: 2020-09-04T14:59:50Z

All versions of `lighter-vm` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: lighter-vm, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
SQL Injection via GeoJSON in sequelize
Advisory: GHSA-5v9h-q3gj-c32x (CVE-2016-1000225)
Published: 2020-09-01T15:27:40Z

Affected versions of `sequelize` are vulnerable to SQL Injection in Models that have fields with the `GEOMETRY` DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using `ST_GeomFromGeoJSON`, and MySQL GeoJSON documents using `GeomFromText`.


## Recommendation

Update to version 3.23.6 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: sequelize, ranges: type: ECOSYSTEM, events: introduced: 3.4.0
fixed: 3.23.6
Cross-Site Scripting in node-red
Advisory: GHSA-5g6j-8hv4-vfgj ()
Published: 2020-09-11T21:21:19Z

Versions of `node-red` prior to 0.18.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the `name` field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 0.18.6 or later.

Affected packages:
package: ecosystem: npm, name: node-red, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.18.6
Malicious Package in json-serializer
Advisory: GHSA-chh2-rvhg-wqwr ()
Published: 2020-09-03T21:02:10Z

Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Affected packages:
package: ecosystem: npm, name: json-serializer, ranges: type: ECOSYSTEM, events: introduced: 2.0.10
fixed: 2.0.11, versions: 2.0.10
Malicious Package in js-rha3
Advisory: GHSA-95cg-3r4g-7w6j ()
Published: 2020-09-03T23:01:29Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-rha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in yzt
Advisory: GHSA-q48g-p5cx-c7c7 (CVE-2017-16221)
Published: 2020-09-01T17:36:42Z

Affected versions of `yzt` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: yzt, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Lack of URL normalization may lead to authorization bypass when URL access rules are used
Advisory: GHSA-x44x-r84w-8v67 (CVE-2020-24660)
Published: 2020-09-09T18:45:55Z

### Impact
When access rules are used inside a protected host, some URL encodings may bypass filtering system.

### Patches
Version 0.5.2 includes a patch that fixes the vulnerability

### Workarounds
No way for users to fix or remediate the vulnerability without upgrading

### References
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [this repository](https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/issues) or [LemonLDAP::NG GitLab](https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues)
* Email us at [lemonldap-ng-users@ow2.org](mailto:lemonldap-ng-users@ow2.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: lemonldap-ng-handler, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.5.2
Contao Insert tag injection in forms
Advisory: GHSA-f7wm-x4gw-6m23 (CVE-2020-25768)
Published: 2020-09-24T16:23:54Z

### Impact

It is possible to inject insert tags in frontend forms which will be replaced when the page is rendered.

### Patches

Update to Contao 4.4.52, 4.9.6 or 4.10.1.

### Workarounds

Disable the front end login form and do not use form fields with array keys such as `fieldname[]`.

### References

https://contao.org/en/security-advisories/insert-tag-injection-in-forms

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: contao/core-bundle, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.4.52
package: ecosystem: Packagist, name: contao/core-bundle, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 4.5.0
fixed: 4.9.6
package: ecosystem: Packagist, name: contao/core-bundle, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 4.10.0
fixed: 4.10.1, versions: 4.10.0
Malicious Package in ember-power-timepicker
Advisory: GHSA-28f8-hqmc-7ph8 ()
Published: 2020-09-11T21:19:09Z

Version 1.0.8 of `ember-power-timepicker` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.7

Affected packages:
package: ecosystem: npm, name: ember-power-timepicker, versions: 1.0.8
Directory Traversal in enserver
Advisory: GHSA-5c6f-jpx7-cwq6 (CVE-2017-16209)
Published: 2020-09-01T18:13:11Z

Affected versions of `enserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: enserver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in web3-eht
Advisory: GHSA-29fh-xcjr-p7rx ()
Published: 2020-09-03T17:02:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: web3-eht, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Denial of Service in apostrophe
Advisory: GHSA-pv6r-vchh-cxg9 ()
Published: 2020-09-03T20:42:09Z

Versions of `apostrophe` prior to 2.97.1 are vulnerable to Denial of Service. The `apostrophe-jobs` module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to start a large number of jobs and exhaust system memory.


## Recommendation

Upgrade to version 2.97.1 or later.

Affected packages:
package: ecosystem: npm, name: apostrophe, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.97.1
Malicious Package in buffer-xoz
Advisory: GHSA-j6x7-42x2-hpcf ()
Published: 2020-09-03T22:14:20Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xoz, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Arbitrary Code Execution in handlebars
Advisory: GHSA-2cf5-4w76-r9qv ()
Published: 2020-09-04T14:57:38Z

Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

The following template can be used to demonstrate the vulnerability:  
```{{#with "constructor"}}
	{{#with split as |a|}}
		{{pop (push "alert('Vulnerable Handlebars JS');")}}
		{{#with (concat (lookup join (slice 0 1)))}}
			{{#each (slice 2 3)}}
				{{#with (apply 0 a)}}
					{{.}}
				{{/with}}
			{{/each}}
		{{/with}}
	{{/with}}
{{/with}}```


## Recommendation

Upgrade to version 3.0.8, 4.5.2 or later.

Affected packages:
package: ecosystem: npm, name: handlebars, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.8
package: ecosystem: npm, name: handlebars, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.5.2
Malicious Package in react-dates-sc
Advisory: GHSA-5645-gc7h-98h8 ()
Published: 2020-09-01T20:32:07Z

Version 0.3.0 of `react-dates-sc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.3.0 of this module is found installed you will want to replace it with a version before or after 0.3.0. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.3.0-beta.83

Affected packages:
package: ecosystem: npm, name: react-dates-sc, versions: 0.3.0
Insecure Cryptography Algorithm in simple-crypto-js
Advisory: GHSA-5v7r-jg9r-vq44 ()
Published: 2020-09-03T21:19:46Z

Versions of `simple-crypto-js` prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.


## Recommendation

Upgrade to version 2.3.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: simple-crypto-js, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.0
Insecure Default Configuration in graphql-code-generator
Advisory: GHSA-9w87-4j72-gcv7 ()
Published: 2020-09-02T18:27:54Z

Versions of `graphql-code-generator` prior to 0.18.2 have an Insecure Default Configuration. The packages sets `NODE_TLS_REJECT_UNAUTHORIZED` to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process.


## Recommendation

Upgrade to version 0.18.2 or later.

Affected packages:
package: ecosystem: npm, name: graphql-code-generator, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.18.2
Malicious Package in mogodb-core
Advisory: GHSA-g4m3-rpxr-h7vg ()
Published: 2020-09-03T19:52:25Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: mogodb-core, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in crpyto-js
Advisory: GHSA-73c6-vwjh-g3qh ()
Published: 2020-09-03T19:40:46Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: crpyto-js, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in jajajejejiji
Advisory: GHSA-rggq-f2wf-m6cp ()
Published: 2020-09-02T18:31:08Z

All versions of `jajajejejiji` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jajajejejiji, ranges: type: ECOSYSTEM, events: introduced: 0
Sandbox Breakout / Arbitrary Code Execution in veval
Advisory: GHSA-54qm-37qr-w5wq ()
Published: 2020-09-04T15:04:20Z

All versions of `veval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: veval, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bitcroe-lib
Advisory: GHSA-4m3p-x2hp-2pgx ()
Published: 2020-09-04T16:45:23Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcroe-lib, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in jquery.json-viewer
Advisory: GHSA-v9wp-8r97-v6xg ()
Published: 2020-09-03T17:17:00Z

Versions of `jquery.json-viewer` prior to 1.3.0 are vulnerable to Cross-Site Scripting (XSS). The package insufficiently sanitizes user input when creating links, and concatenates the user input in an `<a>` tag. This allows attackers to create malicious links with JSON payloads such as: 
```
{
  "foo": "https://bar.com\" onmouseover=alert('xss') \""
}
```

This may lead to arbitrary JavaScript execution in a victim's browser.


## Recommendation

Upgrade to version 1.3.0 or later.

Affected packages:
package: ecosystem: npm, name: jquery.json-viewer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.0
Insufficient Entropy in parsel
Advisory: GHSA-vjvw-wcmw-pr26 ()
Published: 2020-09-04T17:37:08Z

All versions of `parsel` use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key stretching. This allows for the use of keys of insufficient entropy with inappropriate key stretching.


## Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.

Affected packages:
package: ecosystem: npm, name: parsel, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in commqnder
Advisory: GHSA-4xgp-xrg3-c73w ()
Published: 2020-09-11T21:10:29Z

All versions of `commqnder` contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: commqnder, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in asnyc
Advisory: GHSA-v99v-xgjx-7m7g ()
Published: 2020-09-02T18:40:47Z

All versions of `asnyc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: asnyc, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in cuffer-xor
Advisory: GHSA-6xm4-p6r2-mwrc ()
Published: 2020-09-03T22:47:30Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: cuffer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in uekw1511server
Advisory: GHSA-pm44-7gw9-6g8p (CVE-2017-16185)
Published: 2020-09-01T18:28:08Z

Affected versions of `uekw1511server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: uekw1511server, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Denial of Service in ammo
Advisory: GHSA-mg85-8mv5-ffjr ()
Published: 2020-09-03T15:45:40Z

All versions of `ammo` are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

This package is deprecated and is now maintained as `@hapi/ammo`. Please update your dependencies to use `@hapi/ammo`. 

Affected packages:
package: ecosystem: npm, name: ammo, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in requset
Advisory: GHSA-w7wg-24g3-2c78 ()
Published: 2020-09-02T21:14:17Z

All versions of `requset` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: requset, ranges: type: ECOSYSTEM, events: introduced: 0
Command Injection in traceroute
Advisory: GHSA-rjvj-673q-4hfw ()
Published: 2020-09-04T17:54:31Z

All versions of `traceroute` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `exec` call, which may allow attackers to execute arbitrary code in the system. The `trace` function is vulnerable and can be abused if the `host` value is controlled by an attacker.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: traceroute, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
User Impersonation in converse.js
Advisory: GHSA-w973-2qcc-p78x (CVE-2017-5858)
Published: 2020-09-11T21:19:09Z

Versions of `converse.js` prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of [XEP-0280: Message Carbons](https://xmpp.org/extensions/xep-0280.html) that allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks.


## Recommendation

If you're using `converse.js` 1.x, upgrade to 1.0.7 or later.
If you're using `converse.js` 2.x, upgrade to 2.0.5 or later.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: converse.js, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.7
package: ecosystem: npm, name: converse.js, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.5
Malicious Package in jquerz
Advisory: GHSA-c6f3-3c98-2j2f ()
Published: 2020-09-02T21:39:46Z

Version 1.0.1 of `jquerz` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jquerz, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in jr-sha3
Advisory: GHSA-67mp-pcv9-vvq6 ()
Published: 2020-09-03T22:57:14Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jr-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in dmn-js-properties-panel
Advisory: GHSA-h9wr-xr4r-66fh ()
Published: 2020-09-03T18:20:20Z

Versions of `dmn-js-properties-panel` prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.


## Recommendation

Upgrade to version 0.3.0 or later.

Affected packages:
package: ecosystem: npm, name: dmn-js-properties-panel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.0
Malicious Package in ngx-pica
Advisory: GHSA-76wf-2xcf-6wmx ()
Published: 2020-09-03T00:31:28Z

Version 1.1.5 of `ngx-pica` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.1.4

Affected packages:
package: ecosystem: npm, name: ngx-pica, versions: 1.1.5
Malicious Package in log-symboles
Advisory: GHSA-h232-fpqx-mqgr ()
Published: 2020-09-03T21:03:15Z

Version 2.1.0 of `log-symboles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: log-symboles, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in discord.js-user
Advisory: GHSA-69r6-7h4f-9p7q ()
Published: 2020-09-03T20:41:01Z

All versions of `discord.js-user` contain malicious code. The package uploads the user's Discord token to a remote server.


## Recommendation

Remove the package from your environment. Ensure any compromised tokens are invalidated.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: discord.js-user, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in nodes.js
Advisory: GHSA-38vq-cjh5-vw7x ()
Published: 2020-09-03T18:13:41Z

All versions of `nodes.js ` contain malicious code. The package searches and installs globally thousands of packages based on keywords `node`, `react`, `react-native`, `vue`, `angular` and `babel` to fill the system's memory.


## Recommendation

Remove the package from your environment and validate what packages are installed.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: nodes.js, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution
Advisory: GHSA-6pq3-928q-x6w6 (CVE-2020-8147)
Published: 2020-09-03T15:51:28Z

All versions of `utils-extend` are vulnerable to prototype pollution. The `extend` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.

## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: utils-extend, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffer-yor
Advisory: GHSA-g2c4-4m64-vxm3 ()
Published: 2020-09-03T22:15:25Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-yor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in js-sxa3
Advisory: GHSA-jh67-3wqw-cvhr ()
Published: 2020-09-03T23:13:52Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-sxa3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in serve
Advisory: GHSA-cpgr-wmr9-qxv4 ()
Published: 2020-09-11T21:20:14Z

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

Upgrade to version 10.0.2 or later.

Affected packages:
package: ecosystem: npm, name: serve, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 10.0.2
Incorrect Calculation in bigint-money
Advisory: GHSA-9r3m-mhfm-39cm ()
Published: 2020-09-11T21:10:29Z

Versions of `bigint-money` prior to 0.6.2 are vulnerable to an Incorrect Calculation. The package incorrectly rounded certain numbers, which could have drastic consequences due to its usage in financial systems.


## Recommendation

Upgrade to version 0.6.2 or later.

Affected packages:
package: ecosystem: npm, name: bigint-money, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.6.2
Malicious Package in js-sia3
Advisory: GHSA-3mhm-jvqj-fvhg ()
Published: 2020-09-03T23:09:37Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-sia3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in mrk.js
Advisory: GHSA-hpr5-wp7c-hh5q ()
Published: 2020-09-01T19:37:29Z

Versions of `mrk.js` before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.


## Recommendation

Update to version 2.0.1 or later and use `mark.sanitizeURL()` for any `src` and `href` attributes when extending the markdown.

Affected packages:
package: ecosystem: npm, name: mrk.js, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.1
Downloads Resources over HTTP in roslib-socketio
Advisory: GHSA-xq8r-r72r-pqwm (CVE-2016-10681)
Published: 2020-09-01T16:13:18Z

Affected versions of `roslib-socketio` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `roslib-socketio`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.


Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: roslib-socketio, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bictoinjs-lib
Advisory: GHSA-hwh3-fhf6-73x9 ()
Published: 2020-09-04T15:36:09Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bictoinjs-lib, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bconi
Advisory: GHSA-7j93-5m2h-rvjx ()
Published: 2020-09-04T15:32:46Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bconi, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in semantic-ui-search
Advisory: GHSA-p9vv-3945-x93h ()
Published: 2020-09-02T15:47:10Z

All versions of `semantic-ui-search` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: semantic-ui-search, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in coinpayment
Advisory: GHSA-3h99-v4qw-p2h5 ()
Published: 2020-09-03T19:41:56Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: coinpayment, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in swagger-ui
Advisory: GHSA-mrx7-8hxf-f853 (CVE-2016-1000233)
Published: 2020-09-01T15:36:27Z

Affected versions of `swagger-ui` are vulnerable to cross-site scripting. This vulnerability exists because `swagger-ui` automatically executes external Javascript that is loaded in via the `url` query string parameter when a `Content-Type: application/javascript` header is included.

An attacker can create a server that replies with a malicious script and the proper content-type, and then craft a `swagger-ui` URL that includes the location to their server/script in the `url` query string parameter. When viewed, such a link would execute the attacker's malicious script.


## Recommendation

Update to 2.2.1 or later.

Affected packages:
package: ecosystem: npm, name: swagger-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.1
Malicious Package in conistring
Advisory: GHSA-cfc5-x58f-869w ()
Published: 2020-09-03T19:40:55Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: conistring, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in soket.io
Advisory: GHSA-wp2p-q35g-3rjj ()
Published: 2020-09-01T21:13:01Z

All versions of `soket.io` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: soket.io, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in bitcoijns-lib
Advisory: GHSA-37vc-gwvp-6cgv ()
Published: 2020-09-04T15:42:49Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcoijns-lib, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
RCE in Symfony
Advisory: GHSA-754h-5r27-7x3r (CVE-2020-15094)
Published: 2020-09-02T17:29:56Z

Description
-----------

The `CachingHttpClient` class from the HttpClient Symfony component relies on the `HttpCache` class to handle requests. `HttpCache` uses internal headers like `X-Body-Eval` and `X-Body-File` to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by `CachingHttpClient` and if an attacker can control the response for a request being made by the `CachingHttpClient`, remote code execution is possible.

Resolution
----------

HTTP headers designed for internal use in `HttpCache` are now stripped from remote responses before being passed to `HttpCache`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78) for the 4.4 branch.

Credits
-------

I would like to thank Matthias Pigulla (webfactory GmbH) for reporting and fixing the issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: symfony/http-kernel, ranges: type: ECOSYSTEM, events: introduced: 4.3.0
fixed: 4.4.13
package: ecosystem: Packagist, name: symfony/http-kernel, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.1.5
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 4.3.0
fixed: 4.4.13
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.1.5
Prototype Pollution in @hapi/subtext
Advisory: GHSA-g9cg-h3jm-cwrc ()
Published: 2020-09-03T15:47:23Z

Versions of `@hapi/subtext` prior to 6.1.3 or 7.0.3 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.


## Recommendation

Upgrade to versions 6.1.3, 7.0.3 or later.

Affected packages:
package: ecosystem: npm, name: @hapi/subtext, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.1.3
package: ecosystem: npm, name: @hapi/subtext, ranges: type: ECOSYSTEM, events: introduced: 7.0.0
fixed: 7.0.3
Malicious Package in cxct
Advisory: GHSA-c5xm-m64m-f2vq ()
Published: 2020-09-04T15:23:47Z

All versions of `cxct` contain malicious code. The package finds and exfiltrates cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: cxct, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in epress
Advisory: GHSA-vf8q-pw7h-r2x2 ()
Published: 2020-09-11T21:15:54Z

Version 4.13.2 of `epress` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: epress, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in calk
Advisory: GHSA-9mmw-3fmh-96g3 ()
Published: 2020-09-02T20:23:38Z

All versions of `calk` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: calk, ranges: type: ECOSYSTEM, events: introduced: 0
Insecure Defaults Leads to Potential MITM in ezseed-transmission
Advisory: GHSA-p788-rj37-357w (CVE-2016-1000224)
Published: 2020-09-01T15:26:35Z

Affected versions of `ezseed-transmission` download and run a script over an HTTP connection.

An attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running `ezseed-transmission`.



## Recommendation

Update to version 0.0.15 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: ezseed-transmission, ranges: type: ECOSYSTEM, events: introduced: 0.0.10
fixed: 0.0.15, database_specific: last_known_affected_version_range: <= 0.0.14
Malicious Package in signqle
Advisory: GHSA-m794-qv59-gj7c ()
Published: 2020-09-03T17:03:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: signqle, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in grunt-radic
Advisory: GHSA-9p49-cwh3-4qhf ()
Published: 2020-09-11T21:21:19Z

Version 0.1.1 of `grunt-radic` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.1.0

Affected packages:
package: ecosystem: npm, name: grunt-radic, versions: 0.1.1
Directory Traversal in myprolyz
Advisory: GHSA-pr8j-3v7m-j4vv (CVE-2017-16156)
Published: 2020-09-01T17:21:45Z

Affected versions of `myprolyz` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: myprolyz, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0