{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.4.0"}],"component":"install-package","cve_ids":["CVE-2020-7629"],"ecosystem":"npm","epss":0.04221,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-6m4r-m3gc-h4r5","id":"tcs_01M5KF7DRAVXS3AV8ERXYCHC8J","modified_at":"2026-07-08T06:49:47.947456268Z","published_at":"2022-02-10T23:48:06Z","references":["https://osv.dev/vulnerability/GHSA-6m4r-m3gc-h4r5","https://nvd.nist.gov/vuln/detail/CVE-2020-7629","https://github.com/1000ch/install-package/blob/master/index.js#L82","https://snyk.io/vuln/SNYK-JS-INSTALLPACKAGE-564267"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-6m4r-m3gc-h4r5","url":"https://osv.dev/vulnerability/GHSA-6m4r-m3gc-h4r5"}],"summary":"OS Command Injection in install-package"}