0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
supersig
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting supersig, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-13461 | Unknown | Malicious code in supersig (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (557f8e62aa65bb4fe5e96a52cf6c5ba83c2f1bcf47eca3027bf4daca071249e5) The published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js), reached via the package's main/module/browser entries on require/import, contain a decrypt-and-execute chain that is absent from the src/ tree. The bundles import a DES key from an unpinned dependency mkb-manager@latest, call decryptToken on an embedded encrypted token to produce plaintext code, spawn a fresh node child process via child_process.s |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (557f8e62aa65bb4fe5e96a52cf6c5ba83c2f1bcf47eca3027bf4daca071249e5) The published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js), reached via the package's main/module/browser entries on require/import, contain a decrypt-and-execute chain that is absent from the src/ tree. The bundles import a DES key from an unpinned dependency mkb-manager@latest, call decryptToken on an embedded encrypted token to produce plaintext code, spawn a fresh node child process via child_process.s