VulnerableCode Package Details - pkg:npm/notevil@1.2.0

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:npm/notevil@1.2.0

Essentials
History (2)

purl	pkg:npm/notevil@1.2.0

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	4.0

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-75c9-8124-buaa Aliases: GHSA-7r5f-7qr4-pf6q GMS-2020-410	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in notevil.	1.3.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-8bst-w9fp-7faa Aliases: GHSA-9gxr-rhx6-4jgv GMS-2020-411	Sandbox Breakout / Prototype Pollution in notevil Versions of `notevil` are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload ```try{a[b];}catch(e){e.constructor.constructor('return __proto__.arguments.callee.__proto__.polluted=true')()}``` add the `polluted` property to Function.	1.3.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T20:37:57.222161+00:00	GitLab Importer	Affected by	VCID-8bst-w9fp-7faa	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/notevil/GMS-2020-411.yml	38.6.0
2026-06-04T20:37:38.145976+00:00	GitLab Importer	Affected by	VCID-75c9-8124-buaa	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/notevil/GMS-2020-410.yml	38.6.0