Snyk Security Database

persona-ai-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

privacypass-py is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the email validation rule when its multiple option is enabled. An attacker can block the Node.js event loop by submitting a long run of whitespace with no separator to a field validated with Joi.string().email({ multiple: true }), because the value is split with a regex whose leading \s* is retried from each position inside a whitespace run and backtracks through the rest of it, costing n squared steps for n whitespace characters. This is reached only when the application validates untrusted input with the multiple email option and applies no length limit before the email rule runs.