Snyk Security Database

@viertechjs/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

tallyboxlite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the client authentication flow in the client policies and assertion handling components. An attacker can authenticate with weaker client credentials by supplying a fake unsigned assertion header that makes the server believe the policy requirements have been satisfied. This defeats administrator-mandated requirements for signed JWT assertions and lets a client complete authentication with a simpler method such as a client secret, weakening client authentication controls.