0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
framework-zero
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting framework-zero, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-15500 | Unknown | Malicious code in framework-zero (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b) package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry version range. On npm install this URL is fetched and installed, running any lifecycle scripts in the returned tarball, with no version pin and no integrity check. The dependency key equals the package's own name (framework-zero), a dependency-confusion shape where the manifest itself is the delive |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b) package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry version range. On npm install this URL is fetched and installed, running any lifecycle scripts in the returned tarball, with no version pin and no integrity check. The dependency key equals the package's own name (framework-zero), a dependency-confusion shape where the manifest itself is the delive