npm - OSV

GHSA-qqmp-wf37-98f9

npm/@opentelemetry/instrumentation-cassandra-driver
npm/@opentelemetry/instrumentation-knex
npm/@opentelemetry/instrumentation-mongoose
npm/@opentelemetry/instrumentation-mysql
npm/@opentelemetry/instrumentation-mysql2
... 3 more

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 05 Oct

Fix available
Severity - 5.8 (Medium)

MAL-2026-6922

npm/mcp-server-pg

Malicious code in mcp-server-pg (npm) 07 Jul

No fix available

MAL-2026-5959

npm/@mastra/pg

Malicious code in @mastra/pg (npm) 17 Jun

No fix available

MAL-2026-4639

npm/pg-expense-example

Malicious code in pg-expense-example (npm) 22 May

No fix available

MAL-2025-13132

npm/@zalastax/nolb-pg

Malicious code in @zalastax/nolb-pg (npm) 14 Aug 2025

No fix available

MAL-2025-13714

npm/@zalastax/nolb-react-pg

Malicious code in @zalastax/nolb-react-pg (npm) 14 Aug 2025

No fix available

MAL-2025-16622

npm/cashfree-pg-koa-app

Malicious code in cashfree-pg-koa-app (npm) 14 Aug 2025

No fix available

GHSA-ff9h-848c-4xfj

npm/pg-promise

pg-promise SQL Injection vulnerability 12 Jun 2025

Fix available
Severity - 5.4 (Medium)

MAL-2024-9670

npm/instrumentation-pg

Malicious code in instrumentation-pg (npm) 16 Oct 2024

No fix available

MAL-2022-7152

npm/winston-pg-native

Malicious code in winston-pg-native (npm) 20 Jun 2022

No fix available

GHSA-j32j-2hxv-rqf7

npm/libpq
npm/pg-native

pg-native and libpq vulnerable to uncontrolled resource consumption 18 Jun 2022

Fix available
Severity - 7.5 (High)

MAL-2022-2320

npm/dai-pg

Malicious code in dai-pg (npm) 02 Jun 2022

No fix available

MAL-2022-5312

npm/pg-ng-popover

Malicious code in pg-ng-popover (npm) 18 May 2022

No fix available

GHSA-xqh8-5j36-4556

npm/connect-pg-simple

SQL Injection in connect-pg-simple 26 Aug 2019

Fix available
Severity - 7.3 (High)

GHSA-wc9v-mj63-m9g5

npm/pg

Remote Code Execution in pg 24 Jul 2018

Fix available
Severity - 9.8 (Critical)

Vulnerabilities