0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
brass-common
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting brass-common, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-17849 | Unknown | Malicious code in brass-common (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (657abbbfdd17b21af7ad85e8634e0fb2ac36e35c6b95996322f10584ef4c1570) brass-common@99.9.1 declares its only dependency `ltidisafe` as a direct HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.6.tgz) in package.json rather than a registry version range. `npm install` fetches and installs whatever bytes that URL currently returns, with no version pin, no integrity hash, and no registry review, and runs any lifecycle scripts inside that tarball on the installer's machine. The shipp |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (657abbbfdd17b21af7ad85e8634e0fb2ac36e35c6b95996322f10584ef4c1570) brass-common@99.9.1 declares its only dependency `ltidisafe` as a direct HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.6.tgz) in package.json rather than a registry version range. `npm install` fetches and installs whatever bytes that URL currently returns, with no version pin, no integrity hash, and no registry review, and runs any lifecycle scripts inside that tarball on the installer's machine. The shipp