0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
debugcli
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting debugcli, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-6790 | Unknown | Malicious code in debugcli (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ff9ad8188112d91f0ea673971f4421ca96dc7943ba12d65c7339c1aa75c2226e) The package name `debugcli` shadows the popular `debug` package, and `index.js` is a thin re-export (`module.exports = require('debug')`) so callers observe legitimate behavior. The real payload runs via `"postinstall": "node install.js"` in package.json. On install, `install.js` performs: (1) bulk credential-file harvest — reads `~/.aws/credentials`, `~/.aws/config`, `~/.npmrc`, `~/.ssh/config`, `~/.pypirc`, `~/.netrc`, `~/.docker/config.j |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ff9ad8188112d91f0ea673971f4421ca96dc7943ba12d65c7339c1aa75c2226e) The package name `debugcli` shadows the popular `debug` package, and `index.js` is a thin re-export (`module.exports = require('debug')`) so callers observe legitimate behavior. The real payload runs via `"postinstall": "node install.js"` in package.json. On install, `install.js` performs: (1) bulk credential-file harvest — reads `~/.aws/credentials`, `~/.aws/config`, `~/.npmrc`, `~/.ssh/config`, `~/.pypirc`, `~/.netrc`, `~/.docker/config.j