sqlite.js is malware

🗓️ 23 Jul 2018 20:50:29Reported by GitHub Advisory DatabaseType

Malicious sqlite.js package steals environment variables and sends them to attacker controlled locations. All versions removed from npm registry. Security concern: how it got installed. Recommendations: delete, clear npm cache, check other package.json files, regenerate sensitive credentials, review exposed services.

Reporter	Title	Published	Views	Family All 9
CVE	CVE-2017-16050	4 Jun 201819:00	–	cve
Cvelist	CVE-2017-16050	4 Jun 201819:00	–	cvelist
EUVD	EUVD-2018-0235	7 Oct 202500:30	–	euvd
Node.js	Hijacked Environment Variables	8 Aug 201721:38	–	nodejs
NVD	CVE-2017-16050	4 Jun 201819:29	–	nvd
OpenVAS	Malicious JavaScript Package Detection	12 Jun 201800:00	–	openvas
OSV	GHSA-6F34-PQ9F-36VF sqlite.js is malware	23 Jul 201820:50	–	osv
Prion	Code injection	4 Jun 201819:29	–	prion
Veracode	Malicious Typo-Squatting	5 Jun 201807:04	–	veracode