0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
redman89405-my-module
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting redman89405-my-module, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-17336 | Unknown | Malicious code in @redman89405/my-module (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ee7d38498dcd2e2a3afc4ed3b3a5136cb88e11693ef59fc7676bf35cd89b932c) The package ships `code.png` alongside `index.js` and exports a function `imageToCode` that reads a length-prefixed byte stream from the first pixel row of the PNG and passes the decoded string to `Function(...)()`, an eval-equivalent sink. The executable content is hidden inside an image asset rather than present as readable source, so the code that will run cannot be seen by inspecting the npm tarball. The API is exported alongside trivia |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ee7d38498dcd2e2a3afc4ed3b3a5136cb88e11693ef59fc7676bf35cd89b932c) The package ships `code.png` alongside `index.js` and exports a function `imageToCode` that reads a length-prefixed byte stream from the first pixel row of the PNG and passes the decoded string to `Function(...)()`, an eval-equivalent sink. The executable content is hidden inside an image asset rather than present as readable source, so the code that will run cannot be seen by inspecting the npm tarball. The API is exported alongside trivia