Snyk Security Database

@webapp-shared/login-vmok is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

trajmetrics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the _resolveAndValidateGeneric() and _validateTypeParameter() methods of the DatabindContext class. An attacker can instantiate arbitrary classes by supplying a class-name type ID whose generic arguments or array element type name a class that is not validated, because only the outer type is checked against the PolymorphicTypeValidator. Exploitation requires deserializing untrusted JSON with class-name type IDs, through annotation-based polymorphism or default typing, where the outer base type is approved, and a usable gadget class is on the classpath.