cli

Arbitrary File Write in cli

easywebpack-cli Path Traversal vulnerability

Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise

Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys

Malicious code in @bingads-webui-clientcenter/instrumentation (npm)

Malicious code in mongodb-atlas-cli-toc-generator (npm)

Malicious code in markdownlint-cli2-action (npm)

Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE

Malicious code in aws-features-signin-proxy-client (npm)

Malicious code in vistar-ad-clienttestadv3 (npm)

Malicious code in chain-promised-cli (npm)

Malicious code in @_wnpm/wnpm-cli (npm)

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

Malicious code in changelog-cli-logger (npm)

Insecure Defaults Allow MITM Over TLS in engine.io-client

Malicious code in apollocli8ent (npm)

Malicious code in apigeeclientlib (npm)

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

@aofl/cli-lib Prototype Pollution vulnerability

Directory Traversal in fast-http-cli

Imperative CLI vulnerable to Command Injection

Malicious code in client-lambda (npm)

Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused

Command injection in samba-client

npm CLI exposing sensitive information through logs

Outray has a Race Condition in the cli's webapp

Switcher Client contains Regular Expression Denial of Service (ReDoS)

Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles

vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)

OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

Http request which redirect to another hostname do not strip authorization header in @actions/http-client

Apprite CLI makes Use of Hard-coded Credentials

GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution

Paperclip: OS Command Injection via Execution Workspace cleanupCommand

Clipboard-based DOM-XSS

Malicious code in eclipse-typescript (npm)

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

Malicious code in edx_cli (npm)

Malicious code in marketplace-frontend-client-config (npm)

HAX CMS application pages vulnerable to clickjacking

Paperclip: Malicious skills able to exfiltrate and destroy all user data

Directory Traversal in datachannel-client

Malicious code in signalr-temp-client (npm)

OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants

Malicious code in ganach-cli (npm)

Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode

OAuth 2.1 Provider: Unprivileged users can register OAuth clients

OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

Malicious code in haufe-axera-api-client (npm)

Malicious code in @tw-marionette/clipboard (npm)

OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

Snyk CLI affected by Command Injection vulnerability

Malicious code in adk-cli (npm)

Malicious code in cart-client-js (npm)

Downloads Resources over HTTP in co-cli-installer

Malicious code in brave-bitgo-client (npm)

gruntcli is malware

Malicious code in centrifuge-cli (npm)

XSS in client rendered block templates in rendr

Malicious code in apache-httpclient (npm)

paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Malicious code in client-sdk-contract-tests (npm)

Malicious code in clinstestpackage (npm)

basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()

Malicious code in core-client-1 (npm)

LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

Nuclide Improper Input Validation

Unauthorized npm publish of cline@2.3.0 with modified postinstall script

Malicious code in eclipse-megamovie-build (npm)

OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing

Remote code execution in Eclipse Theia

Malicious code in dds-client-side-logger (npm)

Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality

Malicious code in @epc-infra/clinstestpackage (npm)

Malicious code in media-types-v3-lro-client (npm)

OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

Malicious code in ganache-cli-coverage (npm)

Malicious code in newclick-components (npm)

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

Malicious code in iot-central-high-availability-clients (npm)

OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

@npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following

@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass

OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions

Malicious code in bitpay-rest-client (npm)

Malicious code in newclick-composite-components (npm)

Malicious code in test-task-react-client (npm)

Malicious code in apimanagementclient (npm)

Malicious code in apl-client (npm)

Malicious code in ca-bucky-client (npm)

Malicious code in client-sync (npm)

Malicious code in clientlib-manifests (npm)

Malicious code in clipobard (npm)

Malicious code in clispmner (npm)

Malicious code in share-service-client (npm)

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Malicious code in cabelcli (npm)

Malicious code in carpenter-api-client (npm)

Malicious code in click-out-report-website (npm)

Malicious code in adroit-websdk-client (npm)

Malicious code in frontend-restclient (npm)

Malicious code in grenache-fib-client (npm)

@react-native-community/cli has arbitrary OS command injection

OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

Malicious code in kiosk-cli (npm)

Malicious code in inteken-app-client (npm)

OpenClaw skills.status could leak secrets to operator.read clients

Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)

Outray cli is vulnerable to race conditions in tunnels creation

Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath

Malicious code in appetize-cli (npm)

Malicious code in wix-bi-logger-client (npm)

Malicious code in cms-serviceclients (npm)

Malicious code in cms-serviceclients-extensions (npm)

Malicious code in marketing-jest-cli (npm)

Malicious code in eg-clickstream-sdk-js (npm)

Malicious code in 47cliens_server (npm)

Malicious code in twitch-intl-cli (npm)

Malicious code in oc-active-conversation-module-client (npm)

Malicious code in legacy-client-ebay (npm)

Malicious code in afe-host-client (npm)

express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network

Malicious code in uphold-client-credentials-oauth (npm)

Malicious code in uphold-client-credentials-oauth-sample (npm)

Malicious code in miew-cli (npm)

Malicious code in discordjs-webclients (npm)

Malicious code in zcli-monorepo (npm)

OpenClaw: Endpoint persists after trust decline, leaking gateway credentials

UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email

Insufficient Verification of Data Authenticity in Eclipse Theia

Malicious code in startrek-client (npm)

Malicious code in @xvideos/core-clients (npm)

Malicious code in qlkube-client (npm)

Malicious code in @postman/mcp-ui-client (npm)

Cross-site Scripting (XSS) in Eclipse Theia

Electron: Crash in clipboard.readImage() on malformed clipboard image data

apiconnect-cli-plugins vulnerable to OS Command Injection

Malicious code in preact-cli-build (npm)

Malicious code in @voiceflow/runtime-client-js (npm)

Malicious code in ampersend-client (npm)

OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl

Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server

Malicious code in mwp-localtunnel-client (npm)

Malicious code in selenium-session-client (npm)

Malicious code in elasticsearch-client-specification (npm)

Malicious code in client-req-bans (npm)

Malicious code in client-req-scopes (npm)

Malicious code in client-s3 (npm)

Malicious code in zeroclickinfo-goodies (npm)

Malicious code in firehose-poc-client (npm)

Clipboard-based XSS

Malicious code in spex-node-client (npm)

Malicious code in @authentication-pages/vue-cli-prebuild (npm)

Malicious code in drift-v1-cli (npm)

Malicious code in npm-cli-docs (npm)

Malicious code in advertising-api-javascript-client (npm)

Malicious code in @asyncapi/modelina-cli (npm)

Malicious code in evm-checkcode-cli (npm)

Malicious code in pc-analytics-promotion-creation-client (npm)

Malicious code in @pergel/cli (npm)

Malicious code in @lessondesk/api-client (npm)

Malicious code in @varsityvibe/api-client (npm)

Malicious code in xeno-client (npm)

Malicious code in multer-cli (npm)

Zowe CLI allows storage of previously entered secure credentials in a plaintext file

Malicious code in @btu-tools/master-builder-client (npm)

Malicious code in crypto-com-developer-platform-client (npm)

Malicious code in vistar-ad-clienttestadv2 (npm)

OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay

Malicious code in common-cli-utils (npm)

Malicious code in ecmascript-runtime-client (npm)

Malicious code in cline (npm)

Malicious code in browser-gaming-client (npm)

Malicious code in eclipse-tractusx-github-io (npm)

Malicious code in msl-example-client (npm)

Malicious code in @polymarket-developers/clob-client (npm)

Malicious code in mender-cli (npm)

Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization

Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints

Malicious code in @workleap-widgets/client (npm)

LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`

Malicious code in iot-sdk-device-client-rest-api (npm)

Malicious code in @uc-platform/advertisement-service-client (npm)

Malicious code in zk-settlement-client (npm)

Malicious code in chai-promised-cli (npm)

Malicious code in dotenv-node-cli (npm)

Malicious code in x-clients-features (npm)

Malicious code in node-cli-dotenv (npm)

Malicious code in fitbit-connect-client-api (npm)

Malicious code in @3stripes/api-client (npm)

Malicious code in kaltura-ngx-client (npm)

Malicious code in stats-api-js-client (npm)

Malicious code in bitpay-push-notification-client (npm)

Malicious code in media-types-v3-client (npm)

Malicious code in paysafe-client-proxy (npm)

Malicious code in mag-client (npm)

Malicious code in gemini-cli-vscode-ide-companion (npm)

Malicious code in artifact-registry-client (npm)

Malicious code in chai-await-cli (npm)

Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

Malicious code in sparkling-cli (npm)

Malicious code in webpack-cli.legacy (npm)

Malicious code in house-click (npm)

Malicious code in bytecode-checker-cli (npm)

client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

Malicious code in nsg-setclient (npm)

Malicious code in platform-client-messaging-service (npm)

Malicious code in system-library-gameanalytics-client (npm)

Malicious code in env-cli-express (npm)

Malicious code in cdk-cli-wrapper (npm)

DOM Clobbering Gadget found in astro's client-side router that leads to XSS

Malicious code in @radancy/dropr-client (npm)

Malicious code in sd-pdc-module-client (npm)

Malicious code in angularonlineauthclient (npm)

Malicious code in telia-eventapi-client (npm)

Downloads Resources over HTTP in cobalt-cli

Malicious code in scan-cli (npm)

Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions

Malicious code in npm-cli-release-please (npm)

Malicious code in @posthog/cli (npm)

Malicious code in spotify-abba-client (npm)

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Malicious code in browser-client-neptune (npm)

Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode

Malicious code in @loybung/hyper-client (npm)

Malicious code in svc-js-cli (npm)

Malicious code in @postman/postman-mcp-cli (npm)

Malicious code in sensay-cli (npm)

Malicious code in graphclient (npm)

Malicious code in @elektra-web/client (npm)

Malicious code in avax-js-cli-tools (npm)

Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Malicious code in amazon-q-developer-streaming-client (npm)

Malicious code in @bitwarden/cli (npm)

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

Malicious code in @tinkoff-react-bui/click-outside (npm)

Malicious code in traceviz-client-core (npm)

babelcli is malware

glob CLI: Command injection via -c/--cmd executes matches with shell:true

Malicious code in clientcore-base-serviceclients (npm)

Malicious code in exchange_clients (npm)

Malicious code in simple-progress-cli (npm)

Malicious code in mattermost-oauth2-client-sample-app (npm)

Malicious code in nuclide-marshalers-client (npm)

Malicious code in telegram-client (npm)

Malicious code in markdownalint-cli2 (npm)

Malicious code in @strava/clio (npm)

Malicious code in @x-mlbtv/client-utils (npm)

Malicious code in telegramclients (npm)

`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization

Malicious code in minicom-support-client (npm)

OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

Malicious code in @dev-blinq/cucumber_client (npm)

Malicious code in swagger-express-cli (npm)

Malicious code in training-client (npm)

Malicious code in @x-clients/features (npm)

Malicious code in react-ldclient-default-values (npm)

Malicious code in meta-ai-client (npm)

Malicious code in tilled-api-client (npm)

Malicious code in sushi-client (npm)

Malicious code in corewebclient (npm)

Malicious code in cli-e2e (npm)

Malicious code in needlecast_mvd_ads_site_client (npm)

Malicious code in @reserach_org_jfhalsdhfkslsfds/openai-client-gadfjgfsf (npm)

Malicious code in deskera-cli (npm)

Malicious code in tag-manager-client (npm)

TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction

Malicious code in dexclient (npm)

Malicious code in mexc-cli (npm)

Malicious code in prisma-clients (npm)

Malicious code in bookingcom-api-client (npm)

Malicious code in @arkadium/eagle-user-client (npm)

Malicious code in mdp-client (npm)

Malicious code in client-file-manager-module (npm)

Malicious code in client-microsite-reactjs-controls (npm)

Malicious code in videoclientedgecooperation (npm)

Malicious code in dkpusherclient (npm)

Malicious code in oc-ccm-module-client (npm)

Malicious code in vso-service-worker-client (npm)

orval MCP client is vulnerable to a code injection attack.

Malicious code in @sodexo-connect/sap-cdc-client (npm)

Malicious code in @dpdgroupuk/your-dpd-rest-api-client (npm)

Malicious code in speedtestclix (npm)

Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

Malicious code in clicio (npm)

Malicious code in eclipse-tslint (npm)

Malicious code in emberclihtmcbars (npm)

Malicious code in python-statface-client (npm)

Malicious code in @platform-clientextensions/rum-web (npm)

Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass

Malicious code in grenache-nodejs-fib-client (npm)

Malicious code in xterm-addon-clipboard (npm)

Directory Traversal in rtcmulticonnection-client

Malicious code in client-analytisc-sdk (npm)

Malicious code in @grubhubprod/order-taking-client-sdk (npm)

@vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability

Malicious code in flox-web-client (npm)

Malicious code in wormhole-client (npm)

Malicious code in xfi-client-core (npm)

Malicious code in @mint-lib/query-client (npm)

Malicious code in sensort-cli (npm)

Malicious code in jannah-client (npm)

Malicious code in claudcode-cli (npm)

Malicious code in @sky-it-livedata-libraries/livedata-commons-client (npm)

Malicious code in binarium-client (npm)

Malicious code in 000webhost-api-client (npm)

Malicious code in sd-ccp-module-client (npm)

Malicious code in sd-cip-module-client (npm)

Malicious code in @uc-platform/user-service-client-ts (npm)

Malicious code in unity-httpclient (npm)

Malicious code in mdp-client-web (npm)

Malicious code in dotenv-cli-node (npm)

Malicious code in dcapps-cli (npm)

Malicious code in clob-client-sdks (npm)

Malicious code in client-analysis (npm)

Malicious code in cyclic-dep-2 (npm)

Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client

Malicious code in ua-aio-h5-client (npm)

Malicious code in sign-client (npm)

Malicious code in platform-client (npm)

Malicious code in polymesh-cli (npm)

Malicious code in @mcp-use/cli (npm)

Malicious code in techdocs-cli-embedded-app (npm)

Malicious code in errorboosterclient (npm)

Malicious code in vistar-ad-clienttestadv4 (npm)

Malicious code in bbc-http-client (npm)

Malicious code in swagger-cli-express (npm)

Malicious code in chainlink-api-client (npm)

Malicious code in client-recommendation (npm)

Malicious code in @lessondesk/electron-group-api-client (npm)

Malicious code in zmp-cli-dev (npm)

Malicious code in blinqio-executions-cli (npm)

Malicious code in @sbt_gitverse/analytics-client (npm)

Malicious code in climate-tokenization-engine-ui (npm)

Malicious code in ory-hydra-mock-oauth2-client (npm)

Malicious code in dvpawebwidgetsdetailspageclient (npm)

Malicious code in @clickhouse-team/backup-components (npm)

Malicious code in @clickhouse-team/clickhouse-backups-plugin (npm)

Malicious code in @kvytech/cli (npm)

Malicious code in bi-client-sdk (npm)

Malicious code in kikimrclient (npm)

Malicious code in @funnel-analysis/isengard-client (npm)

Malicious code in novi-cli (npm)

Malicious code in n-messaging-client (npm)

Malicious code in calling-stateful-client (npm)

Malicious code in n11-web-client (npm)

Malicious code in 1ds-cli (npm)

Malicious code in roots-cms-client (npm)

Malicious code in sid-client-manager (npm)

Malicious code in plywood-clickhouse-requester (npm)

Malicious code in miro-api-clients (npm)

Malicious code in sd-conversation-history-module-client (npm)

Malicious code in sd-navbar-module-client (npm)

Malicious code in coinmate-typescript-client (npm)

Malicious code in nim-status-client (npm)

Malicious code in skills-strategy-client (npm)

Malicious code in microsoft-cms-client (npm)

Malicious code in @rsi-core-services/rsi-authorization-client (npm)

Malicious code in wallet-cli-tools (npm)

Malicious code in clientcore-models-catalyst (npm)

Malicious code in clientcore-onesrv-businesslogic (npm)

Malicious code in clientcore-onesrv-serviceclients (npm)

Malicious code in jet-client (npm)

Malicious code in sds-oauth-client (npm)

Malicious code in wixstore-client-worker (npm)

Malicious code in area_cliente_front (npm)

Malicious code in smithy-client (npm)

Malicious code in ivx-cloud-client-v1 (npm)

Malicious code in isg-iwp-web-client (npm)

Malicious code in transify-helper-cli (npm)

Malicious code in yandex-passport-vault-client (npm)

Malicious code in studiolabs-cli (npm)

Malicious code in mitui-base-client (npm)

Malicious code in cmc-client (npm)

Malicious code in node-click (npm)

Malicious code in telegramclient-sdk (npm)

Malicious code in ember-cli-progress-ci (npm)

Malicious code in @adminproxy/module-utils-client (npm)

Malicious code in ing-open-banking-cli (npm)

Malicious code in @logistics-frontend/client-core (npm)

Malicious code in grenache-nodejs-example-fib-client (npm)

Malicious code in it-advisor-webclient (npm)

Malicious code in chai-cli-async (npm)

Malicious code in dotenv-mono-cli (npm)

Malicious code in needlecast_prodeng_bfg_ui_consumerclient (npm)

Malicious code in career-service-client (npm)

Malicious code in your-dpd-rest-api-client (npm)

Malicious code in discord-clients (npm)

Malicious code in @ascend-ops/web-client (npm)

Malicious code in aio-cli-config (npm)

Malicious code in @mlbtv-clients/isu (npm)

Malicious code in stateful-fastclick (npm)

Malicious code in hb-websocket-client (npm)

Malicious code in client-utility-module (npm)

Malicious code in faust-nx-cli (npm)

Malicious code in 3commas-api-client (npm)

Malicious code in clientcore-catalyst-businesslogic (npm)

Malicious code in climate-warehouse (npm)

Malicious code in dazaar-cli (npm)

Malicious code in gql-test-client (npm)

Malicious code in openstack-api-client (npm)

Malicious code in health-bot-onboarding-client (npm)

Malicious code in client-desktop-web-installer (npm)

Malicious code in p4clients (npm)

Malicious code in openpass-sample-sites-client-js-sdk (npm)

Malicious code in fe-avaya-chat-client (npm)

Malicious code in airslate-api-client (npm)

Malicious code in cyclic-dep-1 (npm)

Malicious code in appqos-client (npm)

Malicious code in near-abi-client-js (npm)

Malicious code in @zeos-libs/auth-client (npm)

Malicious code in @zipmex/events-stream-client (npm)

Malicious code in flow-inflation-client (npm)

Malicious code in @xvideos/client (npm)

Malicious code in nextcapital-client-demo (npm)

Malicious code in @xvideos/client-api (npm)

Malicious code in sitewidesearch-client (npm)

Malicious code in keymakerclientapi (npm)

Malicious code in cli-wasm (npm)

Malicious code in typeahead-client-logger (npm)

Malicious code in business_api_client (npm)

Malicious code in click-action-framework (npm)

Malicious code in wagyu-cli (npm)

Malicious code in clientcore-base-businesslogic (npm)

Malicious code in @live-backstage/client (npm)

Malicious code in @ans-exam/client (npm)

Malicious code in @caretive/caret-cli (npm)

Malicious code in yandex-yt-transfer-manager-client (npm)

Malicious code in chain-cli-promised (npm)

Malicious code in icv2-plugin-client (npm)

Malicious code in pod-api-client (npm)

Malicious code in gnache-cli (npm)

Malicious code in influxdb-client-examples (npm)

Malicious code in csv-tool-cli (npm)

Malicious code in freekws-devportal-api-client-angular (npm)

Malicious code in freekws-devportal-api-client-nestjs (npm)

Malicious code in frn-api-client (npm)

Malicious code in kinvey-cli-wrapper (npm)

Malicious code in pvct-cli (npm)

Malicious code in env-node-cli (npm)

Malicious code in quality-cli (npm)

Malicious code in speedtestcliz (npm)

Malicious code in react-full-stack-starter-client (npm)

Malicious code in clarity-vs-code-web-client (npm)

Malicious code in cli-command-with-alias (npm)

Malicious code in share-client (npm)

Malicious code in monorepo-release-cli (npm)

Malicious code in reddit-client-lib (npm)

Malicious code in resume-sourcing-nodejs-client-credentials (npm)

Malicious code in journey-client-reactor (npm)

Malicious code in ref-client-ui (npm)

Malicious code in twenty7tec_client (npm)

Malicious code in creative_design_client (npm)

Malicious code in mdap-cli (npm)

Malicious code in karma-puppeteer-client (npm)

Malicious code in @posthog/clickhouse (npm)

Malicious code in 32red-api-client (npm)

Malicious code in piclite (npm)

Malicious code in @dev-blinq/blinqioclient (npm)

Malicious code in client-admin (npm)

Malicious code in client-cloud-phone (npm)

Malicious code in client-consent (npm)

Malicious code in client-data (npm)

Malicious code in client-mpa (npm)

Malicious code in gps-gateway-client (npm)

Malicious code in @axinom/mosaic-cli (npm)

Malicious code in client-6wr4qk (npm)

Malicious code in id-assert-authz-grant-client (npm)

Malicious code in sdk-client (npm)

Malicious code in @dz-lib/dz-cli (npm)

Malicious code in service-client-ebay (npm)

Malicious code in gitlab-linter-cli (npm)

Malicious code in subspace-chatbot-cli (npm)

Malicious code in globo-ab-client (npm)

Malicious code in kvsclient (npm)

Malicious code in sharded-redis-client (npm)

Malicious code in webpack-cli-v4 (npm)

Malicious code in shopify-cli-action (npm)

Malicious code in shopify-cli-extensions-test-utils (npm)

Malicious code in gnarclientweb (npm)

Malicious code in csat-client (npm)

Malicious code in lyft-service-plugin-service-client (npm)

Malicious code in @takamol/qiwa-api-client (npm)

Malicious code in ing-open-banking-cli-js (npm)

Malicious code in zapier-platform-cli (npm)

Malicious code in samples-cors-typescript-client (npm)

Malicious code in phpseclib (npm)

unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)

Malicious code in cli-color-ext (npm)

SAP HANA Node.js client package vulnerable to Prototype Pollution

Axios npm Supply Chain Incident Impacting @usebruno/cli

jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

Malicious code in needlecast_b9s_jewel_fyc_fe_client (npm)

Malicious code in wn-idv-persona-client (npm)

Malicious code in krnl-cli (npm)

Malicious code in wpt-client (npm)

Malicious code in client-aem-content-engine (npm)

Malicious code in pupeteer-cli (npm)

Malicious code in @asyncapi/cli (npm)

Malicious code in airtable-client (npm)

Malicious code in http-long-poll-client (npm)

Malicious code in voting-client-js (npm)

Malicious code in oc-ccp-module-client (npm)

Malicious code in oc-navbar-module-client (npm)

Malicious code in devstart-cli (npm)

Malicious code in webpack-cli-4 (npm)

Malicious code in auth0-guardian-management-client (npm)

Malicious code in cms-site-api-js-client (npm)

Malicious code in @medusajs/medusa-oas-cli (npm)

Malicious code in cube-sign-cli (npm)

Malicious code in clistsy-node (npm)

OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover

Malicious code in stencil-cli (npm)

Malicious code in safe-client-gateway (npm)

locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

Downloads Resources over HTTP in galenframework-cli

Malicious code in blog-client (npm)

Directory Traversal in fbr-client

Malicious code in client-authentication-module (npm)

Malicious code in client-controls-module (npm)

Duplicate Advisory: 1-Click RCE via Authentication Token Exfiltration From gatewayUrl

Malicious code in cli-tabkle2 (npm)

Malicious code in cors-typescript-client (npm)

Malicious code in mbed-js-simple-client (npm)

Malicious code in selfservicedesk-client (npm)

Malicious code in sssssssignalr-temp-client (npm)

Malicious code in eslint-validation-cli (npm)

Malicious code in oclif-dev (npm)

Malicious code in connectnodewebclient (npm)

Malicious code in @frozen-team-qa/axios-client (npm)

Malicious code in oc-aa-module-client (npm)

Malicious code in new-script-clipox-gt-a-v-h-a-c-k-mon-ey-tp-guns-esp-vehicles-more-1-52-undetected-2023-6yc1p7 (npm)

Malicious code in intercom-client (npm)

Malicious code in @corraldev/cli (npm)

Malicious code in pap-client (npm)

Malicious code in proleis-rest-client (npm)

Malicious code in telegramclient-utils (npm)

Malicious code in @accordproject/markdown-cli (npm)

Malicious code in @sev-ui-verse/axios-client (npm)

Malicious code in tailwind-components-cli (npm)

Malicious code in @idps/contrib-client (npm)

Malicious code in processwithcloudevents-client (npm)

Malicious code in open-telemetry-mini-client (npm)

Malicious code in shutterstock-cli (npm)

Malicious code in lsp-sample-client (npm)

Malicious code in @twilio-client/twilio-client (npm)

Malicious code in client-hash-sdk (npm)

Malicious code in couplus-cli (npm)

Malicious code in checkmkwebapiclient (npm)

Malicious code in zuper-cli (npm)

Malicious code in arc-cli-fc (npm)

Malicious code in @airtel-web/clickstream (npm)

Malicious code in @sev-ui-verse/react-query-client (npm)

Malicious code in asset_cli_tool (npm)

Malicious code in kyutai-client (npm)

Malicious code in @aifabrix/miso-client (npm)

Malicious code in env-express-cli (npm)

Malicious code in lumo-api-client (npm)

Malicious code in sd-active-conversation-module-client (npm)

Malicious code in sd-agent-toolbar-module-client (npm)

Malicious code in client-vue3-dev (npm)

Malicious code in kc-fe-cli (npm)

Malicious code in node-dotenv-cli (npm)