Snyk Security Database

timeout-ts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

ttsfm is a Text-to-Speech API Client with OpenAI compatibility

Affected versions of this package are vulnerable to Information Exposure due to verbose and unsanitized error handling in FFmpeg-related operations. An attacker can deliberately trigger FFmpeg errors using malformed audio inputs or unsupported formats to obtain sensitive internal details such as absolute file paths, directory structures, software versions, stack traces, and execution context, which can be used for reconnaissance and to aid further attacks.

com.vaadin:vaadin-server is a Java framework for modern Java web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the ContextMenuManager and Action classed, when handling Action captions. An attacker can cause scripts to be executed by injecting them into captions.

Note: As of version 23, the Action class is only used by the Spreadsheet component.