0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
search-from-search
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting search-from-search, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-6277 | Unknown | Malicious code in search-from-search (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (06e2e600c7cba50d7cc3cbff52a18f77e508ec66be3a50cd4960f84771598548) package.json registers `node callback.js` as both `preinstall` and `postinstall`, so the payload runs automatically on `npm install`. callback.js collects the full `process.env` (with an in-source comment explicitly stating no masking), the user/uid/gid/homedir/shell, hostname, platform, cwd, local and external IP (via https://api.ipify.org), and CI environment indicators, then POSTs the JSON payload over plain HTTP to the hardcoded endpoin |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (06e2e600c7cba50d7cc3cbff52a18f77e508ec66be3a50cd4960f84771598548) package.json registers `node callback.js` as both `preinstall` and `postinstall`, so the payload runs automatically on `npm install`. callback.js collects the full `process.env` (with an in-source comment explicitly stating no masking), the user/uid/gid/homedir/shell, hostname, platform, cwd, local and external IP (via https://api.ipify.org), and CI environment indicators, then POSTs the JSON payload over plain HTTP to the hardcoded endpoin