2018

The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is kno

rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonn

node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue,

welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to

cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the f

datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory tra

liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to th

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular ex

The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a reg

slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of se

The string module is a module that provides extra string operations. The string module is vulnerable to regular expressi

The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input

The marked module is vulnerable to a regular expression denial of service. Based on the information published in the pub

The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it t

The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this funct

weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue

easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue, giving an attacker access to t

gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attac

pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "..

tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the file

serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to

citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plac

serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue, giving an attacker acce

serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue, giving an attacker

serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to th

dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command inje

The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is requir

tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to

serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker

serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacke

iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker acces

cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker acce

Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an

xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, givi

fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access t

serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue, giving an attacker access to

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized use

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial o

tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacke

list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable

node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, g

A remote code execution vulnerability was found within the pg module when the remote database or query specifies a speci

cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished b

nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by np

smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by

mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm

proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by np

http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished