Loading HuntDB...

GHSA-j336-34q7-cgj3

GitHub Security Advisory

Downloads Resources over HTTP in healthcenter

✓ GitHub Reviewed HIGH Has CVE

Advisory Details

Affected versions of `healthcenter` insecurely download an executable over an unencrypted HTTP connection.

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `healthcenter`.

## Recommendation

This package has been deprecated, and moved to a new package on npm: [`appmetrics`](https://npmjs.com/package/appmetrics).

In order to mitigate this vulnerability, please install the `appmetrics` package in place of `healthcenter` via the following commands:
```
npm uninstall healthcenter -s
npm install appmetrics -s
```

Affected Packages

npm healthcenter
Affected versions: 0 (last affected: 3.0.3)

Related CVEs

Key Information

GHSA ID
GHSA-j336-34q7-cgj3
Published
February 18, 2019 11:42 PM
Last Modified
January 8, 2021 6:38 PM
CVSS Score
7.5 /10
Primary Ecosystem
npm
Primary Package
healthcenter
GitHub Reviewed
✓ Yes

Dataset

Last updated: September 4, 2025 6:16 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.