ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).

mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.

`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.

restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.

A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.

glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a malicious user to read content of any file with known path.

node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path.

angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to read content of any file with known path.

Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request.

Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.

serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of any directory with known path.

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path.

Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

Directory traversal vulnerability in the SmartSite (com_smartsite) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 2019.06.01.

Directory traversal vulnerability in the TFTP service in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors.

Directory traversal vulnerability in the Code-Garage NoticeBoard (com_noticeboard) component 1.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary directories via the showtree parameter.