0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
mjs-eslint-helper
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting mjs-eslint-helper, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-6190 | Unknown | Malicious code in mjs-eslint-helper (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3320fa37492448acdf24a86f8a8735a3fc4d3b329ad156e299a8089df39e2f28) The package decodes base64 string literals via Buffer.from(..., 'base64').toString() and pipes the resulting content into execSync('bash...') and execSync('zsh...') invocations in index.js (lines 9, 101, 117, 194, 195). This is the canonical fingerprint of an install-time/import-time dropper: an obfuscated payload is decoded and executed through a shell interpreter, giving the publisher arbitrary code execution on any machine that installs |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3320fa37492448acdf24a86f8a8735a3fc4d3b329ad156e299a8089df39e2f28) The package decodes base64 string literals via Buffer.from(..., 'base64').toString() and pipes the resulting content into execSync('bash...') and execSync('zsh...') invocations in index.js (lines 9, 101, 117, 194, 195). This is the canonical fingerprint of an install-time/import-time dropper: an obfuscated payload is decoded and executed through a shell interpreter, giving the publisher arbitrary code execution on any machine that installs