0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
sea-bound-siren
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting sea-bound-siren, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-5693 | Unknown | Malicious code in sea-bound-siren (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cd5f2d5cc691968b1bb69f12ea7476c618f6432b42976869906df06312b912c0) On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full process environment (`env | sort`), the contents of `/app/.npmrc`, `/usr/etc/npmrc`, and `/root/.npmrc`, recursive listings and greps under `/app` (searching for `HTB{...}`, secrets, and flag files), and `/proc/*/cmdline` data. The collected blob is base64-encoded and PUT in two halves over plain HTTP to `http://154.57.164.71 |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cd5f2d5cc691968b1bb69f12ea7476c618f6432b42976869906df06312b912c0) On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full process environment (`env | sort`), the contents of `/app/.npmrc`, `/usr/etc/npmrc`, and `/root/.npmrc`, recursive listings and greps under `/app` (searching for `HTB{...}`, secrets, and flag files), and `/proc/*/cmdline` data. The collected blob is base64-encoded and PUT in two halves over plain HTTP to `http://154.57.164.71