tkinter is malware

🗓️ 01 Nov 2018 14:47:21Reported by GitHub Advisory DatabaseType

tkinter package is malware stealing environment variables and sending them to attacker controlled locations. All versions have been unpublished from npm registry. Recommendations to delete the package, clear npm cache, and regenerate sensitive credentials.

Reporter	Title	Published	Views	Family All 10
CNVD	tkinter Information Disclosure Vulnerability	31 May 201800:00	–	cnvd
CVE	CVE-2017-16061	29 May 201820:00	–	cve
Cvelist	CVE-2017-16061	29 May 201820:00	–	cvelist
EUVD	EUVD-2018-0776	7 Oct 202500:30	–	euvd
Node.js	Hijacked Environment Variables	8 Aug 201722:21	–	nodejs
NVD	CVE-2017-16061	29 May 201820:29	–	nvd
OpenVAS	Malicious JavaScript Package Detection	12 Jun 201800:00	–	openvas
OSV	GHSA-RWG6-3FMJ-W4WX tkinter is malware	1 Nov 201814:47	–	osv
Prion	Code injection	29 May 201820:29	–	prion
Veracode	Malicious Typo-Squatting	30 May 201805:41	–	veracode