Homepage

@withgoogle/stitch-sdk@0.0.1-security

security holding package

  • latest version

    0.0.1-security

  • first published

    8 days ago

  • latest version published

    8 days ago

  • View stitch-sdk package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @withgoogle/stitch-sdk package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Malicious Package

    @withgoogle/stitch-sdk is a malicious package. Although this package attempts to impersonate Google's Stitch AI design tool, there is no connection between Google and this package. By squatting the @withgoogle npm scope, a malicious actor published @withgoogle/stitch-sdk in an attempt to mimic the legitimate @google/stitch-sdk package. The attacker included deliberately misleading text in the package's README and CLI help menu, falsely positioning this package as the legitimate "new version" of the SDK.

    How to fix Malicious Package?

    Avoid using all malicious instances of the @withgoogle/stitch-sdk package.

    *
    Go back to all versions of this package