Snyk Security Database

express-nodejs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

BuildStream is an A framework for modelling build pipelines in YAML

Affected versions of this package are vulnerable to Symlink Attack in the tar source plugin when handling archive extraction. An attacker can modify or overwrite arbitrary files on the host system by supplying a malicious tarball containing symlinks during the source fetching process. This is only exploitable if the environment is running on Python versions earlier than 3.12 and the user explicitly fetches an untrusted archive.

org.webjars.npm:brace-expansion is a WebJar for brace-expansion.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the expand_ function, which implements a Bash quirk where a brace group followed by a comma set (e.g. {a},b}) causes the parser to rewrite the input string and restart the scan, absorbing one closing brace per pass. Because each pass re-reads the entire string and the string itself grows by approximately 25 characters per rewrite (due to the escClose sentinel), the work is quadratic in the number of trailing braces, allowing an attacker to block the event loop with a small input. An input of the form '{a}' + '}'.repeat(128000) + ',z}' takes approximately 27 seconds to process while producing only two results, and neither the existing max nor maxLength guards can prevent this because the cost is incurred during parsing before any result set is produced.