0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
sapappgyver-appgyver-descriptors
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting sapappgyver-appgyver-descriptors, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-12507 | Unknown | Malicious code in @sapappgyver/appgyver-descriptors (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f9396712a6bf4b08219d9ed2066ebf8c25a7558b988b6d9bf1c9ae57349a4741) The package declares an `install` lifecycle script that runs `node index.js`, which requires `lib/core.js`; the same module is the package main, so the payload also fires on any `require()` of the package. `lib/core.js` reads the installer's OS username, hostname, and current working-directory basename and encodes them as labels of a DNS subdomain under `oob.sl4x0.xyz`, then issues a `dns.resolve4` lookup — leaking host and user identity to |
| OSV (opens in a new tab) |
- MAL-2026-12507UnknownMalicious code in @sapappgyver/appgyver-descriptors (npm)
all
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f9396712a6bf4b08219d9ed2066ebf8c25a7558b988b6d9bf1c9ae57349a4741) The package declares an `install` lifecycle script that runs `node index.js`, which requires `lib/core.js`; the same module is the package main, so the payload also fires on any `require()` of the package. `lib/core.js` reads the installer's OS username, hostname, and current working-directory basename and encodes them as labels of a DNS subdomain under `oob.sl4x0.xyz`, then issues a `dns.resolve4` lookup — leaking host and user identity to