{"id": "GHSA-9HC2-W9GG-Q6JW", "bulletinFamily": "software", "title": "Malicious Package in boogeyman", "description": "All versions of `boogeyman` are considered malicious. This particular package would download a payload from pastebin.com, eval it to read ssh keys and the users `.npmrc` and send them to a private pastebin account.\n\n\n## Recommendation\n\nThis package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate your ssh keys and your npm token.", "published": "2020-09-01T21:07:41", "modified": "2020-09-01T21:07:41", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://github.com/advisories/GHSA-9hc2-w9gg-q6jw", "reporter": "GitHub Advisory Database", "references": ["https://www.npmjs.com/advisories/677", "https://github.com/advisories/GHSA-9hc2-w9gg-q6jw"], "cvelist": [], "type": "github", "lastseen": "2020-09-02T00:57:44", "edition": 1, "viewCount": 19, "enchantments": {"dependencies": {"references": [{"type": "github", "idList": ["GHSA-9HC2-W9GG-Q6JW"]}, {"type": "nodejs", "idList": ["NODEJS:677"]}], "modified": "2020-09-02T00:57:44", "rev": 2}, "score": {"value": 2.7, "vector": "NONE", "modified": "2020-09-02T00:57:44", "rev": 2}, "vulnersScore": 2.7}, "affectedSoftware": [{"name": "boogeyman", "operator": "lt", "version": "0"}]}

{}