`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.

nodejs-growl: Does not properly sanitize input before passing it to exec

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.

gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.

`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is compounded by `f2e-server` requiring elevated privileges to run.

`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL.

`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hubapi.com endpoint redirects to a HTTP url. Because of this behavior an attacker with the ability to man-in-the-middle a developer or system performing a package installation could compromise the integrity of the installation.