node-opencv is malware

🗓️ 29 Aug 2018 23:50:59Reported by GitHub Advisory DatabaseType

node-opencv package is malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation includes deleting the package, clearing npm cache, removing from package.json files, and regenerating registry credentials and sensitive credentials

Reporter	Title	Published	Views	Family All 12
CNVD	node-opencv design vulnerability	12 Jun 201800:00	–	cnvd
CVE	CVE-2017-16067	7 Jun 201802:00	–	cve
Cvelist	CVE-2017-16067	7 Jun 201802:00	–	cvelist
EUVD	EUVD-2018-0367	7 Oct 202500:30	–	euvd
Node.js	Hijacked Environment Variables	8 Aug 201722:53	–	nodejs
NVD	CVE-2017-16067	7 Jun 201802:29	–	nvd
OpenVAS	Malicious JavaScript Package Detection	12 Jun 201800:00	–	openvas
OSV	CVE-2017-16067	7 Jun 201802:29	–	osv
OSV	GHSA-4X37-5RH2-HP8C node-opencv is malware	29 Aug 201823:50	–	osv
Prion	Code injection	7 Jun 201802:29	–	prion