0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
vaultflow-create-flow
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting vaultflow-create-flow, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-11096 | Unknown | Malicious code in @vaultflow/create-flow (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48) On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 (a gist owned by third-party account 'getchainverse') and passes the returned file contents directly to eval(). The gist is mutable and controlled by an external account, so whatever code that account places in the gist is executed in the installer's Node.js process each time the package is loaded. There is n |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48) On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 (a gist owned by third-party account 'getchainverse') and passes the returned file contents directly to eval(). The gist is mutable and controlled by an external account, so whatever code that account places in the gist is executed in the installer's Node.js process each time the package is loaded. There is n