0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
carousel-controller-mixin
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting carousel-controller-mixin, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-5856 | Unknown | Malicious code in carousel-controller-mixin (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c1a4b1be297682ca77d8a92fc502887ee6d718a5541fa88413acdc6accb3ed97) package.json declares both preinstall and postinstall hooks that execute callback.js on every install. callback.js collects username, uid, hostname, cwd, homedir, local and external IPs (via https.get to api.ipify.org) and probes for CI/cloud credential environment variables (AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN, DOCKER_PASSWORD) along with GITHUB_REPOSITORY/GITHUB_ACTOR/BUILD_NUMBER context. The collected data is POSTed to a hardcode |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c1a4b1be297682ca77d8a92fc502887ee6d718a5541fa88413acdc6accb3ed97) package.json declares both preinstall and postinstall hooks that execute callback.js on every install. callback.js collects username, uid, hostname, cwd, homedir, local and external IPs (via https.get to api.ipify.org) and probes for CI/cloud credential environment variables (AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN, DOCKER_PASSWORD) along with GITHUB_REPOSITORY/GITHUB_ACTOR/BUILD_NUMBER context. The collected data is POSTed to a hardcode