cui-travel-component is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

authlib is a library in building OAuth and OpenID Connect servers.

Affected versions of this package are vulnerable to Incorrect Authorization via the deserialize_compact function. An attacker can bypass intended authorization policies by crafting a signed token with unknown critical header parameters, which are improperly accepted and processed.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Name text field in the publication process. An attacker can execute arbitrary web scripts or HTML in the context of a user's browser by injecting a crafted payload.