See the full list of npm packages compromised in the "SHA1-Hulud npm supply chain incident – Nov 2025" [View compromised packages].
Find out if you have vulnerabilities that put you at risk
Test your applicationsAPPLICATION
OPERATING SYSTEM
| VULNERABILITY | AFFECTS | TYPE | PUBLISHED |
|---|---|---|---|
| email-regexed* | npm | 3 Dec 2025 |
| peewee[,3.18.3) | pip | 3 Dec 2025 |
| next>=14.3.0-canary.77 <15.0.5>=15.1.0 <15.1.9>=15.2.0-canary.0 <15.2.6>=15.3.0-canary.0 <15.3.6>=15.4.0-canary.0 <15.4.8>=15.5.0 <15.5.7>=16.0.0-beta.0 <16.0.7 | npm | 3 Dec 2025 |
| react-server-dom-turbopack>=19.0.0-rc.0 <19.0.1>=19.1.0 <19.1.2>=19.2.0 <19.2.1 | npm | 3 Dec 2025 |
| react-server-dom-parcel>=19.1.0 <19.1.2>=19.2.0 <19.2.1 | npm | 3 Dec 2025 |
| react-server-dom-webpack>=19.0.0-rc.0 <19.0.1>=19.1.0 <19.1.2>=19.2.0 <19.2.1 | npm | 3 Dec 2025 |
| feehi/cms>=0.0.1 | Composer | 3 Dec 2025 |
| org.nutz.cloud:nutzcloud-loach-server[0,] | Maven | 3 Dec 2025 |
| org.nutz.cloud:nutzcloud-literpc[0,] | Maven | 3 Dec 2025 |
| calibreweb[0,] | pip | 3 Dec 2025 |
| mautic/core-lib>=4.0.0-alpha1, <4.4.18>=5.0.0-alpha, <5.2.9>=6.0.0-alpha, <6.0.7 | Composer | 3 Dec 2025 |
| mautic/core>=4.0.0-alpha1, <4.4.18>=5.0.0-alpha, <5.2.9>=6.0.0-alpha, <6.0.7 | Composer | 3 Dec 2025 |
| mautic/core-lib>=4.0.0-alpha1, <4.4.18>=5.0.0-alpha, <5.2.9>=6.0.0-alpha, <6.0.7 | Composer | 3 Dec 2025 |
| mautic/core>=4.0.0-alpha1, <4.4.18>=5.0.0-alpha, <5.2.9>=6.0.0-alpha, <6.0.7 | Composer | 3 Dec 2025 |
| @evershop/evershop<2.1.0 | npm | 3 Dec 2025 |
| dcat/laravel-admin>=0.1.0 | Composer | 3 Dec 2025 |
| org.apache.struts:struts2-core[,6.8.0)[7.0.0,7.1.1) | Maven | 3 Dec 2025 |
| buffer-envjs* | npm | 3 Dec 2025 |
| cpython[0,] | Conan | 3 Dec 2025 |
| python[,3.14.1) | Unmanaged (C/C++) | 3 Dec 2025 |
| facebook/proxygen[2025.08.25.00,2025.12.02.00) | Unmanaged (C/C++) | 3 Dec 2025 |
| vim/vim[,9.1.1947) | Unmanaged (C/C++) | 3 Dec 2025 |
| github.com/haproxytech/kubernetes-ingress/pkg<3.1.13 | Go | 3 Dec 2025 |
| aimeos/ai-cms-grapesjs>=2022.4.1, <2022.10.9>=2023.4.1, <2023.10.15>=2024.4.1, <2024.10.8>=2025.4.1, <2025.10.2 | Composer | 3 Dec 2025 |
| feehi/cms>=0.0.1 | Composer | 3 Dec 2025 |
| sqlparse[,0.5.4) | pip | 3 Dec 2025 |
| feehi/cms>=0.0.1 | Composer | 3 Dec 2025 |
| arcade-mcp-server[,1.9.1) | pip | 3 Dec 2025 |
| arcade-mcp[,1.5.6) | pip | 3 Dec 2025 |
| feehi/cms>=0.0.1 | Composer | 3 Dec 2025 |