npm records
1,373 published records for vendor npm.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 33
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-506 Embedded Malicious Code339
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')107
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')50
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')49
- CWE-400 Uncontrolled Resource Consumption38
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')31
The weakness classes this vendor ships most often: where to look.
CWEAll records
1,373 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | GHSA-8mwq-mj73-qv68No exploit | Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elementsnpm · @sequelize/core · CWE-790 | Critical10.0 | — | — | Feb 16, 2023 |
40Plan | GHSA-9qr9-h5gf-34mpNo exploit | Next.js is vulnerable to RCE in React flight protocolnpm · next · CWE-502 | Critical10.0 | — | — | Dec 3, 2025 |
40Plan | GHSA-rc4v-99cr-pjcmNo exploit | Prototype Pollution in ali-security/mongoosenpm · @seal-security/mongoose-fixed · CWE-1321 | Critical10.0 | — | — | Oct 17, 2023 |
40Plan | GHSA-4vmm-mhcq-4x9jNo exploit | Sandbox Bypass Leading to Arbitrary Code Execution in constantinoplenpm · constantinople | Critical10.0 | — | — | Jun 14, 2019 |
40Plan | GHSA-fmh4-wr37-44fpNo exploit | React Server Components are Vulnerable to RCEnpm · @vitejs/plugin-rsc · CWE-502 | Critical10.0 | — | — | Dec 3, 2025 |
40Plan | GHSA-vr6p-vq2p-6j74No exploit | Withdrawn Advisory: LikeC4 has RCE through vulnerable React and Next.js versionsnpm · likec4 · CWE-502 | Critical10.0 | — | — | Dec 15, 2025 |
39Monitor | GHSA-2vqq-jgxx-fxjcNo exploit | Malicious Package in motiv.scssnpm · motiv.scss · CWE-506 | Critical9.8 | — | — | Sep 11, 2020 |
39Monitor | GHSA-3f97-rj68-2pjfNo exploit | Malicious Package in buffe2-xornpm · buffe2-xor · CWE-506 | Critical9.8 | — | — | Sep 3, 2020 |
39Monitor | GHSA-3fc5-9x9m-vqc4No exploit | Duplicate Advisory: Privilege Escalation in express-cartnpm · express-cart | Critical9.8 | — | — | Jun 3, 2019 |
39Monitor | GHSA-2p62-c4rm-mr72No exploit | Malicious Package in another-date-pickernpm · another-date-picker · CWE-506 | Critical9.8 | — | — | Sep 1, 2020 |
39Monitor | GHSA-2p99-6f47-8x9jNo exploit | Malicious Package in asncnpm · asnc · CWE-506 | Critical9.8 | — | — | Sep 2, 2020 |
39Monitor | GHSA-226w-6hhj-69hpNo exploit | Malicious Package in cal_rdnpm · cal_rd · CWE-506 | Critical9.8 | — | — | Sep 3, 2020 |
39Monitor | GHSA-2q6w-rxf3-4wc9No exploit | Malicious Package in codifynpm · codify · CWE-506 | Critical9.8 | — | — | Sep 1, 2020 |
39Monitor | GHSA-26w7-cxv4-gfx2No exploit | Astro: Remote code execution through AVIF image optimizationnpm · astro · CWE-125 | Critical9.8 | — | — | Sep 8, 2026 |
39Monitor | GHSA-377f-vvrc-9wggNo exploit | Malicious Package in zemennpm · zemen · CWE-506 | Critical9.8 | — | — | Sep 3, 2020 |
39Monitor | GHSA-38vq-cjh5-vw7xNo exploit | Malicious Package in nodes.jsnpm · nodes.js · CWE-506 | Critical9.8 | — | — | Sep 3, 2020 |
39Monitor | GHSA-2hqf-qqmq-pgppNo exploit | Malicious Package in commander-jsnpm · commander-js · CWE-506 | Critical9.8 | — | — | Sep 2, 2020 |
39Monitor | GHSA-277p-xwpp-3jf7No exploit | Malicious Package in rrgodnpm · rrgod · CWE-506 | Critical9.8 | — | — | Sep 2, 2020 |
39Monitor | GHSA-2xw5-3767-qxvmNo exploit | Malicious Package in ng-ui-librarynpm · ng-ui-library · CWE-506 | Critical9.8 | — | — | Sep 11, 2020 |
39Monitor | GHSA-28qq-5f47-r5x2No exploit | Duplicate Advisory: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)npm · gemini-mcp-tool · CWE-78 | Critical9.8 | — | — | Jan 23, 2026 |
39Monitor | GHSA-2mxc-m4c3-wqhqNo exploit | Malicious Package in ruffer-xornpm · ruffer-xor · CWE-506 | Critical9.8 | — | — | Sep 3, 2020 |
39Monitor | GHSA-28f4-mjfq-qrvfNo exploit | Malicious Package in buffes-xornpm · buffes-xor · CWE-506 | Critical9.8 | — | — | Sep 3, 2020 |
39Monitor | GHSA-2563-83p7-f34pNo exploit | Malicious Package in requesttnpm · requestt · CWE-506 | Critical9.8 | — | — | Sep 2, 2020 |
39Monitor | GHSA-2h3x-95c6-885rNo exploit | Malicious Package in river-mocknpm · river-mock · CWE-506 | Critical9.8 | — | — | Sep 3, 2020 |
39Monitor | GHSA-33gc-f8v9-v8hmNo exploit | Malicious Package in ladder-text-jsnpm · ladder-text-js · CWE-506 | Critical9.8 | — | — | Sep 1, 2020 |
- GHSA-8mwq-mj73-qv6840Plan
Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements
CriticalCVSS 10.0No exploitnpm · @sequelize/coreFeb 16, 2023
- GHSA-9qr9-h5gf-34mp40Plan
Next.js is vulnerable to RCE in React flight protocol
CriticalCVSS 10.0No exploitnpm · nextDec 3, 2025
- GHSA-rc4v-99cr-pjcm40Plan
Prototype Pollution in ali-security/mongoose
CriticalCVSS 10.0No exploitnpm · @seal-security/mongoose-fixedOct 17, 2023
- GHSA-4vmm-mhcq-4x9j40Plan
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople
CriticalCVSS 10.0No exploitnpm · constantinopleJun 14, 2019
- GHSA-fmh4-wr37-44fp40Plan
React Server Components are Vulnerable to RCE
CriticalCVSS 10.0No exploitnpm · @vitejs/plugin-rscDec 3, 2025
- GHSA-vr6p-vq2p-6j7440Plan
Withdrawn Advisory: LikeC4 has RCE through vulnerable React and Next.js versions
CriticalCVSS 10.0No exploitnpm · likec4Dec 15, 2025
- GHSA-2vqq-jgxx-fxjc39Monitor
Malicious Package in motiv.scss
CriticalCVSS 9.8No exploitnpm · motiv.scssSep 11, 2020
- GHSA-3f97-rj68-2pjf39Monitor
Malicious Package in buffe2-xor
CriticalCVSS 9.8No exploitnpm · buffe2-xorSep 3, 2020
- GHSA-3fc5-9x9m-vqc439Monitor
Duplicate Advisory: Privilege Escalation in express-cart
CriticalCVSS 9.8No exploitnpm · express-cartJun 3, 2019
- GHSA-2p62-c4rm-mr7239Monitor
Malicious Package in another-date-picker
CriticalCVSS 9.8No exploitnpm · another-date-pickerSep 1, 2020
- GHSA-2p99-6f47-8x9j39Monitor
Malicious Package in asnc
CriticalCVSS 9.8No exploitnpm · asncSep 2, 2020
- GHSA-226w-6hhj-69hp39Monitor
Malicious Package in cal_rd
CriticalCVSS 9.8No exploitnpm · cal_rdSep 3, 2020
- GHSA-2q6w-rxf3-4wc939Monitor
Malicious Package in codify
CriticalCVSS 9.8No exploitnpm · codifySep 1, 2020
- GHSA-26w7-cxv4-gfx239Monitor
Astro: Remote code execution through AVIF image optimization
CriticalCVSS 9.8No exploitnpm · astroSep 8, 2026
- GHSA-377f-vvrc-9wgg39Monitor
Malicious Package in zemen
CriticalCVSS 9.8No exploitnpm · zemenSep 3, 2020
- GHSA-38vq-cjh5-vw7x39Monitor
Malicious Package in nodes.js
CriticalCVSS 9.8No exploitnpm · nodes.jsSep 3, 2020
- GHSA-2hqf-qqmq-pgpp39Monitor
Malicious Package in commander-js
CriticalCVSS 9.8No exploitnpm · commander-jsSep 2, 2020
- GHSA-277p-xwpp-3jf739Monitor
Malicious Package in rrgod
CriticalCVSS 9.8No exploitnpm · rrgodSep 2, 2020
- GHSA-2xw5-3767-qxvm39Monitor
Malicious Package in ng-ui-library
CriticalCVSS 9.8No exploitnpm · ng-ui-librarySep 11, 2020
- GHSA-28qq-5f47-r5x239Monitor
Duplicate Advisory: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)
CriticalCVSS 9.8No exploitnpm · gemini-mcp-toolJan 23, 2026
- GHSA-2mxc-m4c3-wqhq39Monitor
Malicious Package in ruffer-xor
CriticalCVSS 9.8No exploitnpm · ruffer-xorSep 3, 2020
- GHSA-28f4-mjfq-qrvf39Monitor
Malicious Package in buffes-xor
CriticalCVSS 9.8No exploitnpm · buffes-xorSep 3, 2020
- GHSA-2563-83p7-f34p39Monitor
Malicious Package in requestt
CriticalCVSS 9.8No exploitnpm · requesttSep 2, 2020
- GHSA-2h3x-95c6-885r39Monitor
Malicious Package in river-mock
CriticalCVSS 9.8No exploitnpm · river-mockSep 3, 2020
- GHSA-33gc-f8v9-v8hm39Monitor
Malicious Package in ladder-text-js
CriticalCVSS 9.8No exploitnpm · ladder-text-jsSep 1, 2020