0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
rio-design-tokens
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting rio-design-tokens, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-6956 | Unknown | Malicious code in rio-design-tokens (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ed72d8256a1831ef61f01d101c9b9de21db822516cb3b61d1fffd1ef7b3bb0c7) rio-design-tokens@99.99.100 is a dependency-confusion attack package. package.json declares `preinstall: node index.js`, so `npm install` auto-executes index.js, which harvests installer secrets and system data and POSTs them to an attacker-controlled oastify.com (Burp Collaborator) subdomain. Specifically, index.js collects `os.hostname()`, `os.userInfo()`, output of `whoami`/`id`/`pwd` (via `execSync` with curl and other commands), the co |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ed72d8256a1831ef61f01d101c9b9de21db822516cb3b61d1fffd1ef7b3bb0c7) rio-design-tokens@99.99.100 is a dependency-confusion attack package. package.json declares `preinstall: node index.js`, so `npm install` auto-executes index.js, which harvests installer secrets and system data and POSTs them to an attacker-controlled oastify.com (Burp Collaborator) subdomain. Specifically, index.js collects `os.hostname()`, `os.userInfo()`, output of `whoami`/`id`/`pwd` (via `execSync` with curl and other commands), the co