@ftapi/components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature. An attacker can bypass signature validation by introducing a timestamp response signature that chains to a trusted root, allowing acceptance of forged timestamp responses.

Affected versions of this package are vulnerable to Directory Traversal via the solon-faas-luffy component. An attacker can access unauthorized files or inject malicious scripts by crafting specially designed requests.