Qix- vulnerabilities
We track 7 vulnerabilities in Qix- products across 7 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2025.
Latest Qix- vulnerabilities
- 8.8 High severity
node-is-arrayish: Embedded Malicious Code
is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malw
- 8.8 High severity
node-error-ex: Embedded Malicious Code
error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware
- 8.8 High severity
color-convert: Embedded Malicious Code
color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version,
- 8.8 High severity
color: Embedded Malicious Code
color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over after a phishing attack. Version 5.0.1 was published, functionally identical to the previous patch version, but with a mal
- 8.8 High severity
color-string: Embedded Malicious Code
color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with a
- 8.8 High severity
node-simple-swizzle: Embedded Malicious Code
simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload
- 8.8 High severity
node-backslash: Embedded Malicious Code
backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload