0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
houzidawang806
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting houzidawang806, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-5729 | Unknown | Malicious code in houzidawang806 (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2dbf603db6d0a3434c6c417dd460f26d08b9e230c03926f05987bb3841d3c72b) Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js enumerates ~/.ssh/ for *.pub files and POSTs the listing along with os.userInfo().username and platform to the hardcoded bare-IP endpoint https://124.221.154.135:443/post. The file's comments explicitly label sections as targets and C2 server in Chinese ('窃取目标', 'C2 服务器', '模拟外传数据到攻击者服务器 (C2)'). The script is shipped in |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2dbf603db6d0a3434c6c417dd460f26d08b9e230c03926f05987bb3841d3c72b) Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. (1) postinstall.js enumerates ~/.ssh/ for *.pub files and POSTs the listing along with os.userInfo().username and platform to the hardcoded bare-IP endpoint https://124.221.154.135:443/post. The file's comments explicitly label sections as targets and C2 server in Chinese ('窃取目标', 'C2 服务器', '模拟外传数据到攻击者服务器 (C2)'). The script is shipped in