@eforms/forms-api
Advanced tools
Affected versions:
Security research canary — authorized dependency-confusion proof of concept for the NatWest bug-bounty programme (Bugcrowd natwest-og). Reports the installing host identity (hostname, username, working directory) to an endpoint controlled by the engagemen
This package is a dependency-confusion proof of concept published as part of an
authorized bug-bounty engagement against NatWest Group (Bugcrowd programme natwest-og).
If your build server installed it, that means your package resolution fell through from a
private registry to public npm for the @eforms scope. The only action this package takes
is to beacon the installing host identity (hostname, username, working directory) to an
endpoint controlled by the researcher, so the fall-through could be demonstrated.
It does not read files, does not read environment variables, does not install a payload, and exits 0. It will be unpublished once the programme has the report.
Contact the programme via the Bugcrowd report this package is referenced from.
FAQs
security holding package
The npm package @eforms/forms-api receives a total of 0 weekly downloads. As such, @eforms/forms-api popularity was classified as not popular.
We found that @eforms/forms-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.
Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.
Security News
Cloudflare introduces tsrs, a Rust port of TypeScript’s compiler promising faster checks and lower memory use, with the TypeScript team’s help.
