aswin1906/github-advisory-2020.csv huggingface dataset:
HTML Injection in preact
Advisory: GHSA-cg48-9hh2-x6mx ()
Published: 2020-09-02T18:28:58Z

Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with `JSON.parse()` to be passed directly into JSX without sanitization.


## Recommendation

Upgrade to version 10.0.0-beta.1.

Affected packages:
package: ecosystem: npm, name: preact, ranges: type: ECOSYSTEM, events: introduced: 10.0.0-alpha.0
fixed: 10.0.0-beta.1, database_specific: last_known_affected_version_range: <= 10.0.0-beta.0
Malicious Package in buffer-8or
Advisory: GHSA-4hm7-73ch-vm59 ()
Published: 2020-09-03T21:49:43Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-8or, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Unintended Require in larvitbase-www
Advisory: GHSA-88h9-fc6v-jcw7 ()
Published: 2020-09-03T20:28:51Z

All versions of `larvitbase-www` are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is running.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: larvitbase-www, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in chatbyvista
Advisory: GHSA-8w74-g84v-c5w8 (CVE-2017-16177)
Published: 2020-09-01T18:52:26Z

Affected versions of `chatbyvista` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: chatbyvista, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in local-devices
Advisory: GHSA-w725-67p7-xv22 ()
Published: 2020-09-03T17:05:04Z

Versions of `local-devices` prior to 3.0.0 are vulnerable to Command Injection. The package does not validate input on ip addresses and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 3.0.0 or later.

Affected packages:
package: ecosystem: npm, name: local-devices, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.0
Arbitrary Code Execution in require-node
Advisory: GHSA-8j6j-4h2c-c65p ()
Published: 2020-09-03T17:02:52Z

Versions of `require-node` prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the `require-node` endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.


## Recommendation

- If you are using 1.x, upgrade to version 1.3.4 or later.
- If you are using 2.x, upgrade to version 2.0.4 or later.

Affected packages:
package: ecosystem: npm, name: require-node, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.4
package: ecosystem: npm, name: require-node, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.4
Command Injection in samsung-remote
Advisory: GHSA-xhjx-mfr6-9rr4 ()
Published: 2020-09-01T21:20:28Z

Versions of `samsung-remote` before 1.3.5 are vulnerable to command injection. This vulnerability is exploitable if user input is passed into the `ip` option of the package constructor.


## Recommendation

Update to version 1.3.5 or later.

Affected packages:
package: ecosystem: npm, name: samsung-remote, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.5
Malicious Package in axois
Advisory: GHSA-wpfc-3w63-g4hm ()
Published: 2020-09-01T21:09:48Z

All versions of `axois` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: axois, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in bufber-xor
Advisory: GHSA-p9g3-vpvp-hcj5 ()
Published: 2020-09-03T21:41:55Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bufber-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bpi39
Advisory: GHSA-762c-v946-pf25 ()
Published: 2020-09-04T16:47:33Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bpi39, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bs58chekc
Advisory: GHSA-fwvq-x4j9-hr5f ()
Published: 2020-09-03T19:43:09Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bs58chekc, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bitcion-ops
Advisory: GHSA-85q4-v37c-wfpc ()
Published: 2020-09-04T15:39:28Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcion-ops, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in scroool
Advisory: GHSA-p7w2-mc6m-mfx2 ()
Published: 2020-09-11T21:22:25Z

Version 0.1.7 of `scroool` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.1.6

Affected packages:
package: ecosystem: npm, name: scroool, versions: 0.1.7
Path Traversal in decompress
Advisory: GHSA-qgfr-5hqp-vrw9 (CVE-2020-12265)
Published: 2020-09-03T21:16:27Z

Versions of `decompress` prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing`../`.


## Recommendation

Upgrade to version 4.2.1 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: decompress, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.2.1
Memory corruption in Tensorflow
Advisory: GHSA-rjjg-hgv6-h69v (CVE-2020-15193)
Published: 2020-09-25T18:28:27Z

### Impact
The implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a tensor:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/python/tfe_wrapper.cc#L1361

However, there is nothing stopping users from passing in a Python object instead of a tensor.
```python
In [2]: tf.experimental.dlpack.to_dlpack([2])                                                                                                                                            
==1720623==WARNING: MemorySanitizer: use-of-uninitialized-value                                                                                                                            
    #0 0x55b0ba5c410a in tensorflow::(anonymous namespace)::GetTensorFromHandle(TFE_TensorHandle*, TF_Status*) third_party/tensorflow/c/eager/dlpack.cc:46:7
    #1 0x55b0ba5c38f4 in tensorflow::TFE_HandleToDLPack(TFE_TensorHandle*, TF_Status*) third_party/tensorflow/c/eager/dlpack.cc:252:26
... 
```

The uninitialized memory address is due to a `reinterpret_cast`
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/python/eager/pywrap_tensor.cc#L848-L850

Since the `PyObject` is a Python object, not a TensorFlow Tensor, the cast to `EagerTensor` fails. 

### Patches
We have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Potential XSS in jQuery dependency in Mirador
Advisory: GHSA-hgwm-pv9h-q5m7 ()
Published: 2020-09-18T18:03:29Z

### Impact
Mirador users less than v3.0.0 (alpha-rc) versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be broken.

### Patches
Mirador adopters should update to v3.0.0, no updates exist for v2.x releases.

### Workarounds
Yes, Mirador users could fork and create their own custom build of Mirador and make the bug fixes themselves.

### References
https://github.com/advisories/GHSA-gxr4-xjj5-5px2
https://github.com/advisories/GHSA-jpcq-cgw6-v4j6


https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

Affected packages:
package: ecosystem: npm, name: mirador, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.0-alpha.0, database_specific: last_known_affected_version_range: <= 2.7.2
Directory Traversal in gaoxuyan
Advisory: GHSA-j9wj-26p5-fj2v (CVE-2017-16153)
Published: 2020-09-01T17:17:29Z

Affected versions of `gaoxuyan` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: gaoxuyan, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in mergify
Advisory: GHSA-3f95-w5h5-fq86 ()
Published: 2020-09-11T21:22:24Z

All versions of `mergify` are vulnerable to Prototype Pollution. The `mergify()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative module as the package is deprecated.

Affected packages:
package: ecosystem: npm, name: mergify, ranges: type: ECOSYSTEM, events: introduced: 0
Denial of Service in ipfs-bitswap
Advisory: GHSA-6fcr-9h9g-23fq ()
Published: 2020-09-02T21:50:51Z

Versions of `ipfs-bitswap` prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used to exhaust system resources in specific conditions.


## Recommendation

Upgrade to version 0.24.1 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/
Affected packages:
package: ecosystem: npm, name: ipfs-bitswap, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.24.1
Malicious Package in pizza-pasta
Advisory: GHSA-wxrm-2h86-v95f ()
Published: 2020-09-03T21:04:20Z

Version 1.0.3 of `pizza-pasta` contains malicious code as a install scripts. The package created folders in the system's Desktop and downloaded an image from `imgur.com`. The package also printed the users SSH keys to the console.


## Recommendation

Remove the package from your environment. There are no evidences of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: pizza-pasta, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in zemen
Advisory: GHSA-377f-vvrc-9wgg ()
Published: 2020-09-03T19:09:07Z

Version 0.0.5 of `zemen` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: zemen, ranges: type: ECOSYSTEM, events: introduced: 0.0.5
fixed: 0.0.6, versions: 0.0.5
Malicious Package in js-sha7
Advisory: GHSA-hvgc-mggg-pxr2 ()
Published: 2020-09-03T23:02:33Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-sha7, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in yeoman-genrator
Advisory: GHSA-f7g4-fm4c-54m9 ()
Published: 2020-09-03T21:06:31Z

Version 2.0.2 of `yoeman-generator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: yeoman-genrator, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in angular-material-sidenav-rnd
Advisory: GHSA-qmxf-fxq7-w59f ()
Published: 2020-09-01T19:43:53Z

Version 0.1.1 of `angular-material-sidenav-rnd` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 0.1.1 of this module is found installed you will want to replace it with a version before or after 0.1.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: angular-material-sidenav-rnd, versions: 0.1.1
Sensitive Data Exposure in rails-session-decoder
Advisory: GHSA-44vf-8ffm-v2qh ()
Published: 2020-09-02T15:42:47Z

All versions of `rails-session-decoder` are missing verification of the Message Authentication Code appended to the cookies. This may lead to decryption of cipher text thus exposing encrypted information.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: rails-session-decoder, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Silently Runs Cryptocoin Miner in hooka-tools
Advisory: GHSA-m36m-x4c5-rjxj ()
Published: 2020-09-01T19:01:58Z

Affected versions of `hooka-tools` were compromised and modified to silently run a cryptocoin miner in the background.

All affected versions have been unpublished from the npm registry.


## Recommendation

While this module has been unpublished, some versions may exist in mirrors or caches. Do not install this module, and remove it if found.

Affected packages:
package: ecosystem: npm, name: hooka-tools, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in dojo
Advisory: GHSA-p82g-2xpp-m5r3 (CVE-2015-5654)
Published: 2020-09-11T21:18:05Z

Versions of `dojo` prior to 1.2.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 1.2.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: dojo, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.1, database_specific: last_known_affected_version_range: < 1.2.0
Directory Traversal in 360class.jansenhm
Advisory: GHSA-25jw-gcfj-283j (CVE-2017-16186)
Published: 2020-09-01T18:27:04Z

Affected versions of `360class.jansenhm` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: 360class.jansenhm, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Denial of Service in hapi
Advisory: GHSA-7hx8-2rxv-66xv ()
Published: 2020-09-03T15:48:00Z

All Versions of `hapi` are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

This package is deprecated and is now maintained as `@hapi/hapi`. Please update your dependencies to use `@hapi/hapi`. 

Affected packages:
package: ecosystem: npm, name: hapi, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in iter-server
Advisory: GHSA-qh38-wrgf-cj2c (CVE-2017-16183)
Published: 2020-09-01T18:48:05Z

Affected versions of `iter-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: iter-server, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Remote Memory Exposure in mongoose
Advisory: GHSA-r5xw-q988-826m ()
Published: 2020-09-01T19:39:37Z

Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.

Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.


## Recommendation

Update to version 4.3.6, 3.8.39 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/
Affected packages:
package: ecosystem: npm, name: mongoose, ranges: type: ECOSYSTEM, events: introduced: 3.5.5
fixed: 3.8.39, database_specific: last_known_affected_version_range: <= 3.8.38
package: ecosystem: npm, name: mongoose, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.6, database_specific: last_known_affected_version_range: <= 4.3.5
Malicious Package in buffev-xor
Advisory: GHSA-x3w4-mrmv-cw2x ()
Published: 2020-09-03T22:19:44Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffev-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in comander
Advisory: GHSA-4xg9-g7qj-jhg4 ()
Published: 2020-09-03T20:46:36Z

All versions of `comander` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: comander, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Buffer Overflow in node-weakauras-parser
Advisory: GHSA-86mr-6m89-vgj3 ()
Published: 2020-09-03T15:51:38Z

Affected versions of `node-weakauras-parser` are vulnerable to a Buffer Overflow. The `encode_weakaura` function fails to properly validate the input size. A buffer of 13835058055282163711 bytes causes an overflow on 64-bit systems.


## Recommendation

Upgrade to versions 1.0.5, 2.0.2, 3.0.1 or later.

Affected packages:
package: ecosystem: npm, name: node-weakauras-parser, ranges: type: ECOSYSTEM, events: introduced: 1.0.4
fixed: 1.0.5
package: ecosystem: npm, name: node-weakauras-parser, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.2
package: ecosystem: npm, name: node-weakauras-parser, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.1
Malicious Package in bqffer-xor
Advisory: GHSA-pxqp-mv67-g528 ()
Published: 2020-09-03T21:38:34Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bqffer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in nginxbeautifier
Advisory: GHSA-28xx-8j99-m32j ()
Published: 2020-09-01T20:37:25Z

Version 1.0.14 of `nginxbeautifier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.14 of this module is found installed you will want to replace it with a version before or after 1.0.14. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: nginxbeautifier, ranges: type: ECOSYSTEM, events: introduced: 1.0.14
fixed: 1.0.15, versions: 1.0.14
Malicious Package in angular-location-update
Advisory: GHSA-53jx-4wwh-gcqj ()
Published: 2020-09-11T21:11:34Z

Version 0.0.3 of `angular-location-update` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.0.2

Affected packages:
package: ecosystem: npm, name: angular-location-update, versions: 0.0.3
Prototype Pollution in @commercial/subtext
Advisory: GHSA-36c4-4r89-6whg ()
Published: 2020-09-03T15:49:02Z

Versions of `@commercial/subtext` prior to 5.1.2 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.


## Recommendation

Upgrade to version 5.1.2 or later.

Affected packages:
package: ecosystem: npm, name: @commercial/subtext, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.1.2
Prototype Pollution in handlebars
Advisory: GHSA-g9r4-xpmj-mj65 ()
Published: 2020-09-04T15:06:32Z

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.


## Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

Affected packages:
package: ecosystem: npm, name: handlebars, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.8
package: ecosystem: npm, name: handlebars, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.5.3
Path Traversal in bruteser
Advisory: GHSA-v7cp-5326-54fh ()
Published: 2020-09-03T16:45:15Z

Versions of `bruteser` prior to 0.1.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 0.1.0 or later.

Affected packages:
package: ecosystem: npm, name: bruteser, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.1.0
Malicious Package in bitcionjs
Advisory: GHSA-qmgf-fp85-55gr ()
Published: 2020-09-04T15:40:34Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcionjs, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in hdkye
Advisory: GHSA-8pwx-j4r6-5v38 ()
Published: 2020-09-03T17:05:25Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: hdkye, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Heap buffer overflow in Tensorflow
Advisory: GHSA-jc87-6vpp-7ff3 (CVE-2020-15198)
Published: 2020-09-25T18:28:22Z

### Impact
The `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has the same shape as the `values` one. The values in these tensors are always accessed in parallel:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L193-L195

Thus, a shape mismatch can result in accesses outside the bounds of heap allocated buffers.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Denial of Service in @commercial/subtext
Advisory: GHSA-fvwr-h9xh-m6wc ()
Published: 2020-09-03T20:33:17Z

Versions of `@commercial/subtext` prior to 5.1.1 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 5.1.1 or later.

Affected packages:
package: ecosystem: npm, name: @commercial/subtext, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.1.1
Malicious Package in asinc
Advisory: GHSA-87qw-7v97-w34r ()
Published: 2020-09-02T18:33:18Z

All versions of `asinc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: asinc, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in angluar-cli
Advisory: GHSA-8mm3-2mcj-cx6r ()
Published: 2020-09-11T21:09:24Z

Version 0.0.3 of `angluar-cli` contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus on macOS.


## Recommendation

Remove the package from your environment and verify whether files were deleted and if processes were stopped.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: angluar-cli, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in eact
Advisory: GHSA-pmgv-94f5-6w7w ()
Published: 2020-09-02T20:21:30Z

All versions of `eact` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: eact, ranges: type: ECOSYSTEM, events: introduced: 0
XXE in Apache Standard Taglibs
Advisory: GHSA-6x4w-8w53-xrvv (CVE-2015-0254)
Published: 2020-09-14T18:44:01Z

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

Affected packages:
package: ecosystem: Maven, name: org.apache.taglibs:taglibs-standard, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.3
package: ecosystem: Maven, name: org.apache.taglibs:taglibs-standard-impl, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.3
Unauthorized File Access in glance
Advisory: GHSA-vw7g-jq9m-3q9v ()
Published: 2020-09-02T18:23:35Z

Versions of `glance` prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a `--nodot` option meant to hide files and directories with names that begin with a `.`, such as `.git` but fails to hide files inside a folder that begins with `.`. 


## Recommendation

Upgrade to version 3.0.7 or later.

Affected packages:
package: ecosystem: npm, name: glance, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.7
Malicious Package in sailclothjs
Advisory: GHSA-m5pf-5894-jmx7 ()
Published: 2020-09-03T19:08:00Z

Version 1.2.6 of `sailclothjs` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider a downgrade to 1.2.5

Affected packages:
package: ecosystem: npm, name: sailclothjs, versions: 1.2.6
Malicious Package in crytpo-js
Advisory: GHSA-m4fq-xh7w-jhfm ()
Published: 2020-09-03T19:39:46Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: crytpo-js, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in hpmm
Advisory: GHSA-vxfp-qmpq-6826 ()
Published: 2020-09-03T17:38:09Z

All versions of `hpmm` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: hpmm, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bitcionjslib
Advisory: GHSA-p4mf-4qvh-w8g5 ()
Published: 2020-09-04T15:41:42Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcionjslib, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Downloads Resources over HTTP in windows-latestchromedriver
Advisory: GHSA-4ccc-jm2p-vg3p (CVE-2016-10696)
Published: 2020-09-01T16:14:22Z

Affected versions of `windows-latestchromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-latestchromedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Affected packages:
package: ecosystem: npm, name: windows-latestchromedriver, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in rate-map
Advisory: GHSA-x48m-gp6r-gp4v ()
Published: 2020-09-03T18:21:26Z

Version 1.0.3 of `rate-map`  contains malicious code. The malware breaks functionality of the `purescript-installer` package by rewriting code of the `dl-tar` dependency.


## Recommendation

Upgrade to version 1.0.5 or later. There is no indication of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: rate-map, ranges: type: ECOSYSTEM, events: introduced: 1.0.3
fixed: 1.0.5, versions: 1.0.3
Malicious Package in qingting
Advisory: GHSA-559q-92vx-xvjp ()
Published: 2020-09-03T17:44:36Z

All versions of `qingting` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: qingting, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in swagger-ui
Advisory: GHSA-vp93-gcx5-4w52 ()
Published: 2020-09-11T21:21:19Z

Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using `<script>` tags in the method descriptions.


## Recommendation

Upgrade to version 2.2.1 or later.

Affected packages:
package: ecosystem: npm, name: swagger-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.1
Malicious Package in siganle
Advisory: GHSA-p5p2-rhc3-wmf3 ()
Published: 2020-09-03T17:03:31Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: siganle, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in browserift
Advisory: GHSA-43vf-2x6g-p2m5 ()
Published: 2020-09-02T21:33:26Z

Version 16.3.3 of `browserift` contained malicious code as a preinstall script. The package was a backdoor that opened a connection to a remote server and executed incoming commands on both Unix and Windows machines


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: browserift, ranges: type: ECOSYSTEM, events: introduced: 0
Cross-Site Scripting in dompurify
Advisory: GHSA-mjjq-c88q-qhr6 ()
Published: 2020-09-03T21:22:00Z

Versions of `dompurify` prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 2.0.7 or later.

Affected packages:
package: ecosystem: npm, name: dompurify, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.7
Malicious Package in js-shc3
Advisory: GHSA-69mf-2cw2-38m8 ()
Published: 2020-09-03T23:04:40Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-shc3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in pdf-image
Advisory: GHSA-5gwh-g79j-vh4q (CVE-2018-3757)
Published: 2020-09-01T20:44:52Z

Versions of `pdf-image` before 2.0.0 are vulnerable to command injection. This vulnerability is exploitable if the attacker has control over the `pdfFilePath` variable passed into `pdf-image`.


## Recommendation

Update to version 2.0.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: pdf-image, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0
Malicious Package in jc-sha3
Advisory: GHSA-gfj6-p24g-6hpm ()
Published: 2020-09-03T22:55:06Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jc-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in mogodb
Advisory: GHSA-w3pp-wp5v-fjvp ()
Published: 2020-09-03T19:51:18Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: mogodb, ranges: type: ECOSYSTEM, events: introduced: 0.0.0