Snyk Security Database

sigcheck is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

mathkitlite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded symbol value caching in the AMQP 1.0 Symbol codec. An attacker can exhaust broker resources by sending pre-authentication AMQP 1.0 traffic that forces the codec to create and retain a large number of distinct symbol values. The vulnerable path is in the AMQP 1.0 protocol handling code under broker-plugins/amqp-1-0-protocol, where symbol decoding caches values during message and type parsing. Repeatedly supplying many unique symbols causes the cache to grow without limit, consuming memory until the broker slows down or becomes unavailable.