Snyk Security Database

opencode2-windows-arm64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the CommandLinker trust mechanism, where a command-link click triggers a trust dialog and, upon user approval, executes the associated trust command without verifying that the DOM boundary being trusted corresponds to the widget that initiated the trust request. An attacker who can embed malicious content in a notebook or Markdown document can cause the trust action to be applied to an unintended widget, effectively bypassing the trust boundary and elevating the privilege of untrusted content.

org.webjars.npm:decompress-zip is an extracts the contents of the ZIP archive file.

Affected versions of this package are vulnerable to Directory Traversal via the extract function in lib/decompress-zip.js, which does not validate that extracted file paths remain within the target directory. An attacker can supply a ZIP archive containing entries with path traversal sequences (e.g., ../) to write arbitrary files outside the intended extraction directory.