0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
progerss-cli
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting progerss-cli, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-5343 | Unknown | Malicious code in progerss-cli (npm)`progerss-cli` is a typosquat of the popular `cli-progress` package that ships an obfuscated payload executed automatically on install. The package borrows trust from its victim: `repository.url` is set to `https://github.com/npkgz/cli-progress` — the legitimate cli-progress project's own repository — and the author field is set to `andidittrich` (the real maintainer). `package.json` defines `scripts.postinstall`: `node build-helper.js`, and declares `form-data` as its only runtime dependency (used for exfiltration). **build-helper.js (load gate):** polls up to 31 times at 1.5 s intervals f |
| OSV (opens in a new tab) |
`progerss-cli` is a typosquat of the popular `cli-progress` package that ships an obfuscated payload executed automatically on install. The package borrows trust from its victim: `repository.url` is set to `https://github.com/npkgz/cli-progress` — the legitimate cli-progress project's own repository — and the author field is set to `andidittrich` (the real maintainer). `package.json` defines `scripts.postinstall`: `node build-helper.js`, and declares `form-data` as its only runtime dependency (used for exfiltration). **build-helper.js (load gate):** polls up to 31 times at 1.5 s intervals f