GHSA-2gqj-wrf5-35w8: add html-to-gutenberg 4.2.12, 4.2.13, 4.2.15, 4.2.16
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 52/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript
- Domain
- security
Research direction
Start with the GHSA-2gqj-wrf5-35w8 advisory and compare its listed html-to-gutenberg versions with the issue. Review the linked OpenSourceMalware case study and OSV update PR for supporting evidence. Done means adding 4.2.12, 4.2.13, 4.2.15, and 4.2.16 while leaving 4.2.14 unchanged.
Written by the indexing model from the issue text.
Description
Advisory
https://github.com/advisories/GHSA-2gqj-wrf5-35w8
Currently lists html-to-gutenberg = 4.2.11 and = 4.2.14.
Requested change
Add:
4.2.124.2.134.2.154.2.16
Leave 4.2.14 as-is. Amazon Inspector reported no malware in that tarball; it is already listed.
Public sources
Same compromised maintainer (digelim / DiogoAngelim) as fetch-page-assets (GHSA-vxq2-vhm7-7mhq). 4.2.12/4.2.13 were published 2026-07-15 (same window as fetch-page-assets 1.2.10/1.2.11). 4.2.15/4.2.16 were published 2026-08-23 (same account-wide burst as fetch-page-assets 1.2.13/1.2.14). These four versions are still listed on npm.
- OpenSourceMalware case study (GitHub repo re-infection in the August burst): https://opensourcemalware.com/blog/polinrider-npm-case-study-dprk-attack
- OSV update PR for MAL-2026-6359: https://github.com/ossf/malicious-packages/pull/1477
Evidence for these four versions is correlative (same maintainer and publish windows, documented GitHub re-infection), not a separate tarball walkthrough. These GHSA malware records do not appear in this git tree, so this is an issue rather than an advisory-file PR.
- Dominant language
- No language data
- Stars
- 2.5k
- Forks
- 772
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 48
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/advisory-database
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#9255 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#9164 · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8994 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#8898 · 4 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8841 ·
All issues in github/advisory-database
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sipyourdrink-ltd/bernstein#6191 ·
-
security severity:low track:open-source
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
[addtool] DeepZero Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
gwen001/offsectools_www#2055 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
WalletConnect/actions#112 ·