0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
bnppf-flag-icons
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting bnppf-flag-icons, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-16350 | Unknown | Malicious code in bnppf-flag-icons (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78) The package ships poc.js and wires it to both preinstall and postinstall lifecycle hooks in package.json, so it runs automatically on `npm install`. poc.js requires `os` and `https`, reads `os.hostname()` and `os.userInfo().username`, and sends them via HTTPS GET to a hardcoded webhook.site collector at https://webhook.site/f3d7a882-435a-4959-a4e9-18a3886f3447. The package name suggests a flag-icons library but the shipped code performs onl |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78) The package ships poc.js and wires it to both preinstall and postinstall lifecycle hooks in package.json, so it runs automatically on `npm install`. poc.js requires `os` and `https`, reads `os.hostname()` and `os.userInfo().username`, and sends them via HTTPS GET to a hardcoded webhook.site collector at https://webhook.site/f3d7a882-435a-4959-a4e9-18a3886f3447. The package name suggests a flag-icons library but the shipped code performs onl