Spectra Assure

failIncident: Malware

Scanned:

hello-world-client-fuck

Artifact:

latest

License: Permissive (MIT)

Published:

SAFE Assessment

Compliance

Licenses

5 weak copyleft linked components

Secrets

2 debugging symbols found

Security

Vulnerabilities

1 patch mandated vulnerabilities

Hardening

5 baseline mitigations missing

Threats

Tampering

1 suspicious application behaviors

Malware

2 malicious components found

INCIDENTS FOR THIS VERSION:

malware

Reported By: ReversingLabs (Automated)

Learn more about malware detection

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/04/19

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

CVSS Score

CVE Identifier

Summary

Tags

critical

10.0

Step CA is vulnerable to an authorization bypass, allowing attackers to create certificates without completing certain protocol authorization checks.

Exploits Exist

Fix Available

critical

10.0

Go's crypto/tls is vulnerable to a session resumption issue due to mutated ClientCAs or RootCAs fields.

Exploits Exist

Fix Available

critical

9.8

Go Template.Parse is vulnerable to arbitrary JavaScript code injection due to improper handling of backticks in template literals.

Fix Available

critical

9.8

JavaScript is affected by a template sanitization vulnerability due to improper handling of whitespace characters.

Fix Available

critical

9.1

RandomAlphaNumeric and CryptoRandomAlphaNumeric functions in unspecified product generate alphanumeric strings with insufficient entropy.

Exploits Exist

Fix Available

critical

9.1

Go's crypto/elliptic Curve.IsOnCurve function incorrectly returns true for invalid field elements.

Fix Available

critical

9.1

Golang's crypto library is susceptible to an authorization bypass due to misuse of the ServerConfig.PublicKeyCallback callback.

Exploits Exist

Fix Available

critical

9.1

net/http improperly accepts a bare LF as a line terminator in chunked data, permitting request smuggling.

Fix Available

high

8.9

Caddy is vulnerable to path confusion, potentially leading to unintended PHP execution of non-.php files due to incorrect FastCGI path splitting logic.

Exploits Exist

Fix Available

high

8.8

Caddy silently fails to enforce mTLS client certificate authentication when a CA certificate file is missing, unreadable, or malformed.

Exploits Exist

Fix Available