aswin1906/github-advisory-2020.csv huggingface dataset:
Malicious Package in bs-sha3
Advisory: GHSA-88xx-23mf-rcj2 ()
Published: 2020-09-03T22:51:52Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bs-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bufner-xor
Advisory: GHSA-7xf6-cpxm-5mx9 ()
Published: 2020-09-03T22:27:18Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bufner-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in react-marked-markdown
Advisory: GHSA-m7qm-r2r5-f77q ()
Published: 2020-09-01T20:43:48Z

All versions of `react-marked-markdown` are vulnerable to cross-site scripting (XSS) via `href` attributes. This is exploitable if user is provided to `react-marked-markdown`

Proof of concept:

```
import React from 'react'
import ReactDOM from 'react-dom'
import { MarkdownPreview } from 'react-marked-markdown'

ReactDOM.render(
<MarkdownPreview
markedOptions={{ sanitize: true }}
value={'[XSS](javascript: alert`1`)'}
/>,
document.getElementById('root')
)
```


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time if you allow user input into href values.


Affected packages:
package: ecosystem: npm, name: react-marked-markdown, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffeb-xor
Advisory: GHSA-5ggx-g294-qj3q ()
Published: 2020-09-03T21:47:29Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffeb-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in commmander
Advisory: GHSA-q42c-rrp3-r3xm ()
Published: 2020-09-11T21:13:44Z

All versions of `commmander` contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: commmander, ranges: type: ECOSYSTEM, events: introduced: 0
Unauthorized File Access in atompm
Advisory: GHSA-v86x-f47q-f7f4 ()
Published: 2020-09-11T21:09:24Z

Versions of `atompm` prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system.


## Recommendation

Upgrade to version 0.8.2 or later.

Affected packages:
package: ecosystem: npm, name: atompm, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.8.2
Malicious Package in buffep-xor
Advisory: GHSA-73wv-v82c-xmqv ()
Published: 2020-09-03T21:50:51Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffep-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in entitlements
Advisory: GHSA-g8vp-6hv4-m67c ()
Published: 2020-09-11T21:23:29Z

Versions of `entitlements` prior to 1.3.0 are vulnerable to Command Injection. The package does not validate input on the `entitlements` function  and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 1.3.0 or later.

Affected packages:
package: ecosystem: npm, name: entitlements, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.0
Malicious Package in fs-extar
Advisory: GHSA-435c-qcpm-wjw5 ()
Published: 2020-09-03T17:05:43Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: fs-extar, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in lodash.merge
Advisory: GHSA-2m96-9w4j-wgv7 ()
Published: 2020-09-03T18:06:00Z

Versions of `lodash.merge` before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.

Affected packages:
package: ecosystem: npm, name: lodash.merge, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.6.1
Server-Side Request Forgery in @uppy/companion
Advisory: GHSA-mm7r-265w-jv6f (CVE-2020-8135)
Published: 2020-09-03T15:51:19Z

Versions of `@uppy/companion` prior to 1.9.3 are vulnerable to Server-Side Request Forgery (SSRF). The `get` route passes the user-controlled variable `req.body.url` to a GET request without sanitizing the value. This allows attackers to inject arbitrary URLs and make GET requests on behalf of the server. 


## Recommendation

Upgrade to version 1.9.3 or later.

Affected packages:
package: ecosystem: npm, name: @uppy/companion, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.3
Directory Traversal in serveryaozeyan
Advisory: GHSA-gqfv-g9f6-3v3m (CVE-2017-16096)
Published: 2020-09-01T16:50:23Z

Affected versions of `serveryaozeyan` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: serveryaozeyan, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Arbitrary Code Execution in handlebars
Advisory: GHSA-q2c6-c6pm-g3gh ()
Published: 2020-09-04T15:07:38Z

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).


## Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

Affected packages:
package: ecosystem: npm, name: handlebars, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.8
package: ecosystem: npm, name: handlebars, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.5.3
Regular Expression Denial of Service in markdown
Advisory: GHSA-wx77-rp39-c6vg ()
Published: 2020-09-04T15:11:03Z

All versions of `markdown` are vulnerable to Regular Expression Denial of Service (ReDoS). The `markdown.toHTML()` function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the parser accepts user input.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: markdown, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Regular Expression Denial of Service in papaparse
Advisory: GHSA-qvjc-g5vr-mfgr ()
Published: 2020-09-04T18:03:04Z

Versions of `papaparse` prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The `parse` function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service.


## Recommendation

Upgrade to version 5.2.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: papaparse, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.2.0
Malicious Package in requets
Advisory: GHSA-f3pc-c2gf-hvgw ()
Published: 2020-09-02T21:13:14Z

All versions of `requets` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: requets, ranges: type: ECOSYSTEM, events: introduced: 0
Reverse Tabnabbing in showdown
Advisory: GHSA-h6mq-3cj6-h738 ()
Published: 2020-09-03T23:21:16Z

Versions of `showdown` prior to 1.9.1 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.


## Recommendation

Upgrade to version 1.9.1 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: showdown, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.1
Cross-Site Scripting in mermaid
Advisory: GHSA-w32g-5hqp-gg6q ()
Published: 2020-09-02T15:41:41Z

Versions of `mermaid` prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input  such as `A["<img src=invalid onerror=alert('XSS')></img>"] ` is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding.


## Recommendation

Upgrade to version 8.2.3 or later

Affected packages:
package: ecosystem: npm, name: mermaid, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 8.2.3
Command Injection in meta-git
Advisory: GHSA-qcff-ffx3-m25c ()
Published: 2020-09-04T17:31:44Z

All versions of `meta-git` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `exec` call, which may allow attackers to execute arbitrary code in the system. The `clone` command is vulnerable through the branch name.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: meta-git, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in babel-loqder
Advisory: GHSA-9cph-cqqh-36pw ()
Published: 2020-09-04T15:29:25Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: babel-loqder, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Sensitive Data Exposure in Apache Ant
Advisory: GHSA-4p6w-m9wc-c9c9 (CVE-2020-1945)
Published: 2020-09-14T18:13:29Z

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.ant:ant, ranges: type: ECOSYSTEM, events: introduced: 1.1
fixed: 1.9.15
package: ecosystem: Maven, name: org.apache.ant:ant, ranges: type: ECOSYSTEM, events: introduced: 1.10.0
fixed: 1.10.8
Denial of Service in sequelize
Advisory: GHSA-fw4p-36j9-rrj3 ()
Published: 2020-09-03T20:25:33Z

Versions of `sequelize` prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a `TypeError` exception for the `results` variable. The `results` value may be undefined and trigger the error on a `.map` call. This may allow attackers to submit malicious input that forces the exception and crashes the Node process.  

The following proof-of-concept crashes the Node process:  
```
const Sequelize = require('sequelize');

const sequelize = new Sequelize({
	dialect: 'sqlite',
	storage: 'database.sqlite'
});

const TypeError = sequelize.define('TypeError', {
	name: Sequelize.STRING,
});

TypeError.sync({force: true}).then(() => {
	return TypeError.create({name: "SELECT tbl_name FROM sqlite_master"});
});
```


## Recommendation

Upgrade to version 4.44.4 or later.

Affected packages:
package: ecosystem: npm, name: sequelize, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.44.4
SQL Injection in untitled-model
Advisory: GHSA-hq8g-qq57-5275 ()
Published: 2020-09-11T21:24:33Z

All versions of `untitled-model` re vulnerable to SQL Injection. Query parameters are not properly sanitized allowing attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: untitled-model, ranges: type: ECOSYSTEM, events: introduced: 0
Downloads Resources over HTTP in adamvr-geoip-lite
Advisory: GHSA-h2jv-5v3f-7m7j (CVE-2016-10680)
Published: 2020-09-01T16:10:03Z

Affected versions of `adamvr-geoip-lite` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Affected packages:
package: ecosystem: npm, name: adamvr-geoip-lite, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in ngx-context-menu
Advisory: GHSA-xwg3-gjxh-c8pm ()
Published: 2020-09-03T19:14:32Z

Version 0.0.26 of `ngx-context-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.0.25

Affected packages:
package: ecosystem: npm, name: ngx-context-menu, versions: 0.0.26
Data corruption in tensorflow-lite
Advisory: GHSA-mxjj-953w-2c2v (CVE-2020-15208)
Published: 2020-09-25T18:28:44Z

### Impact
When determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/types.h#L437-L442

Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors.

### Patches
We have patched the issue in 8ee24e7949a20 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Malicious Package in dossier
Advisory: GHSA-c8h6-89q2-mgv8 ()
Published: 2020-09-01T19:55:48Z

Version 0.0.4 of `dossier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.4 of this module is found installed you will want to replace it with a version before or after 0.0.4. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: dossier, versions: 0.0.4
Malicious Package in jsmsha3
Advisory: GHSA-657v-jjf8-83gh ()
Published: 2020-09-03T23:14:55Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jsmsha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in @hapi/hoek
Advisory: GHSA-22h7-7wwg-qmgg ()
Published: 2020-09-04T17:56:39Z

Versions of `@hapi/hoek` prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The `clone` function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties that exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.  
This issue __does not__ affect hapi applications since the framework protects against such malicious inputs. Applications that use `@hapi/hoek` outside of the hapi ecosystem may be vulnerable.


## Recommendation

Update to version 8.5.1, 9.0.3 or later.

Affected packages:
package: ecosystem: npm, name: @hapi/hoek, ranges: type: ECOSYSTEM, events: introduced: 8.3.2
fixed: 8.5.1
package: ecosystem: npm, name: @hapi/hoek, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.0.3
Command Injection in treekill
Advisory: GHSA-533p-g2hq-qr26 ()
Published: 2020-09-04T17:16:35Z

All versions of `treekill` are vulnerable to Command Injection. The package fails to sanitize values passed to the  `kill` function. If this value is user-controlled it  may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: treekill, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in ember_cli_babe
Advisory: GHSA-vm7j-4rj6-mw2p ()
Published: 2020-09-03T21:08:42Z

Version 6.16.0 of `ember_cli_babe` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: ember_cli_babe, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in smart-extend
Advisory: GHSA-f8h3-rqrm-47v9 ()
Published: 2020-09-02T16:02:40Z

All versions of `smart-extend` are vulnerable to Prototype Pollution. The `deep()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: smart-extend, ranges: type: ECOSYSTEM, events: introduced: 0
Cross-Site Scripting in buttle
Advisory: GHSA-pqpp-2363-649v ()
Published: 2020-09-02T18:22:30Z

All versions of `buttle` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `buttle` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.


Affected packages:
package: ecosystem: npm, name: buttle, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in bubfer-xor
Advisory: GHSA-vm67-mh96-95mq ()
Published: 2020-09-03T21:40:48Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bubfer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Denial of Service in Tensorflow
Advisory: GHSA-9mqp-7v2h-2382 (CVE-2020-15194)
Published: 2020-09-25T18:28:19Z

### Impact
The `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L235-L241

Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of proper shape. Hence, malicious users can pass a bad `grad_values_t` to trigger an assertion failure in `vec`, causing denial of service in serving installations.

### Patches
We have patched the issue in 390611e0d45c5793c7066110af37c8514e6a6c54 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-63xm-rx5p-xvqr](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-63xm-rx5p-xvqr)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Denial of service in tensorflow-lite
Advisory: GHSA-hjmq-236j-8m87 (CVE-2020-15213)
Published: 2020-09-25T18:28:53Z

### Impact
In TensorFlow Lite models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Since code uses the last element of the tensor holding them to determine the dimensionality of output tensor, attackers can use a very large value to trigger a large allocation:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/segment_sum.cc#L39-L44

### Patches
We have patched the issue in 204945b and will release patch releases for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to limit the maximum value in the segment ids tensor. This only handles the case when the segment ids are stored statically in the model, but a similar validation could be done if the segment ids are generated at runtime, between inference steps.

However, if the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered from a variant analysis of [GHSA-p2cq-cprg-frvm](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p2cq-cprg-frvm).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Malicious Package in buffer-zor
Advisory: GHSA-f294-27fc-wgj7 ()
Published: 2020-09-03T22:16:31Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-zor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in @berslucas/liljs
Advisory: GHSA-c53x-wwx2-pg96 ()
Published: 2020-09-03T17:03:58Z

Versions of  `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.


## Recommendation

Upgrade to version 1.0.2 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: @berslucas/liljs, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.2
Directory Traversal in susu-sum
Advisory: GHSA-w7jg-972m-rphv (CVE-2017-16199)
Published: 2020-09-01T18:17:28Z

Affected versions of `susu-sum` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: susu-sum, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in serve
Advisory: GHSA-xw79-hhv6-578c ()
Published: 2020-09-11T21:16:59Z

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered.


## Recommendation

Upgrade to version 10.0.2 or later.

Affected packages:
package: ecosystem: npm, name: serve, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 10.0.2
Malicious Package in asynnc
Advisory: GHSA-5fm9-jmv7-fcx5 ()
Published: 2020-09-02T18:35:26Z

All versions of `asynnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: asynnc, ranges: type: ECOSYSTEM, events: introduced: 0
Denial of Service in @hapi/hapi
Advisory: GHSA-23vw-mhv5-grv5 ()
Published: 2020-09-03T15:48:43Z

Versions of `@hapi/hapi` prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to versions 18.4.1, 19.1.1 or later.

Affected packages:
package: ecosystem: npm, name: @hapi/hapi, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 18.4.1
package: ecosystem: npm, name: @hapi/hapi, ranges: type: ECOSYSTEM, events: introduced: 19.0.0
fixed: 19.1.1
Malicious Package in js-base64-int
Advisory: GHSA-76qf-6mvw-c5hm ()
Published: 2020-09-03T19:45:42Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-base64-int, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in node-buc
Advisory: GHSA-x3m6-rprw-862w ()
Published: 2020-09-03T17:43:31Z

All versions of `node-buc` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: node-buc, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Global node_modules Binary Overwrite in bin-links
Advisory: GHSA-v45m-2wcp-gg98 ()
Published: 2020-09-04T17:18:44Z

Versions of  `bin-links` prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This behavior is still allowed in local installations.


## Recommendation

Upgrade to version 1.1.6 or later.

Affected packages:
package: ecosystem: npm, name: bin-links, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.6
Malicious Package in buffmr-xor
Advisory: GHSA-wv39-cgmm-cq29 ()
Published: 2020-09-03T22:23:00Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffmr-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in marsdb
Advisory: GHSA-5mrr-rgp6-x4gr ()
Published: 2020-09-03T19:39:05Z

All versions of `marsdb` are vulnerable to Command Injection. In the `DocumentMatcher` class, selectors on `$where` clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: marsdb, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in dylmomo
Advisory: GHSA-hpw4-m59j-9p52 (CVE-2017-16163)
Published: 2020-09-01T17:29:13Z

Affected versions of `dylmomo` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: dylmomo, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in js-cha3
Advisory: GHSA-7xf9-74cp-8hx3 ()
Published: 2020-09-03T22:59:21Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-cha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in hsf-clients
Advisory: GHSA-g5q2-fcg9-j526 ()
Published: 2020-09-03T17:40:18Z

All versions of `hsf-clients` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: hsf-clients, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Out of bounds access in tensorflow-lite
Advisory: GHSA-cvpc-8phh-8f45 (CVE-2020-15211)
Published: 2020-09-25T18:28:49Z

### Impact
In TensorFlow Lite, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors, indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array indexing when trying to get the data of each tensor:https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/kernel_util.cc#L36

However, some operators can have some tensors be optional. To handle this scenario, the flatbuffer model uses a negative `-1` value as index for these tensors:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/c/common.h#L82

This results in special casing during validation at model loading time: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/core/subgraph.cc#L566-L580

Unfortunately, this means that the `-1` index is a valid tensor index for any operator, including those that don't expect optional inputs and including for output tensors. Thus, this allows writing and reading from outside the bounds of heap allocated arrays, although only at a specific offset from the start of these arrays.

This results in both read and write gadgets, albeit very limited in scope.

### Patches
We have patched the issue in several commits (46d5b0852, 00302787b7, e11f5558, cd31fd0ce, 1970c21, and fff2c83). We will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that only operators which accept optional inputs use the `-1` special value and only for the tensors that they expect to be optional. Since this allow-list type approach is erro-prone, we advise upgrading to the patched code.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Path Traversal in zero
Advisory: GHSA-crf7-fvjx-863q ()
Published: 2020-09-03T17:09:26Z

Versions of `zero` prior to 1.0.6 are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. 


## Recommendation

Upgrade to version 1.0.6 or later.


Affected packages:
package: ecosystem: npm, name: zero, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.6
Malicious Package in fuffer-xor
Advisory: GHSA-c2g6-57fp-22wp ()
Published: 2020-09-03T22:48:35Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: fuffer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in slush-fullstack-framework
Advisory: GHSA-4j54-mmmv-hjpm ()
Published: 2020-09-03T19:17:51Z

Version 0.9.2 of `slush-fullstack-framework` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.9.1

Affected packages:
package: ecosystem: npm, name: slush-fullstack-framework, versions: 0.9.2
Malicious Package in ladder-text-js
Advisory: GHSA-33gc-f8v9-v8hm ()
Published: 2020-09-01T20:41:40Z

`ladder-text-js` contained a malicious script that attempted to delete all files when `npm test` was run.



## Recommendation

This module has been unpublished from the npm Registry. If you find this module in your environment remove it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: ladder-text-js, ranges: type: ECOSYSTEM, events: introduced: 0
Command Injection in expressfs
Advisory: GHSA-mxmj-84q8-34r7 ()
Published: 2020-09-03T02:39:49Z

All versions of `expressfs` are vulnerable to Command Injection. The package does not validate user input on several API endpoints, allowing attackers to run arbitrary commands in the system. The affected endpoints are: `expressfs.appendFile`,  `expressfs.cp`, `expressfs.create` and `expressfs.rmdir`.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: expressfs, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in bpi66
Advisory: GHSA-7xc4-793x-25jp ()
Published: 2020-09-04T16:48:38Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bpi66, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in @toast-ui/editor
Advisory: GHSA-cr56-66mx-293v ()
Published: 2020-09-03T15:53:50Z

Versions of `@toast-ui/editor` prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS).  There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.

## Recommendation

Upgrade to version 2.2.0 or later.

Affected packages:
package: ecosystem: npm, name: @toast-ui/editor, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.0