GHSA-HWHQ-3HRJ-V6V5 cross-env.js is malware

🗓️ 01 Sep 2020 19:00:54Reported by GoogleType

osv🔗 osv.dev👁 20 Views

`cross-env.js` is malware that steals environment variables and sends them to attacker-controlled locations. All versions have been unpublished from the npm registry. Recommendation: Delete the package, clear npm cache, ensure it's not present in other package.json files, regenerate sensitive credentials, review exposed services

Reporter	Title	Published	Views	Family All 9
CVE	CVE-2017-16081	7 Jun 201802:00	–	cve
Cvelist	CVE-2017-16081	7 Jun 201802:00	–	cvelist
EUVD	EUVD-2020-1114	7 Oct 202500:30	–	euvd
Github Security Blog	cross-env.js is malware	1 Sep 202019:00	–	github
Node.js	Hijacked Environment Variables	9 Aug 201700:00	–	nodejs
NVD	CVE-2017-16081	7 Jun 201802:29	–	nvd
OpenVAS	Malicious JavaScript Package Detection	12 Jun 201800:00	–	openvas
Prion	Design/Logic Flaw	7 Jun 201802:29	–	prion
Veracode	Malicious Typo-Squatting	7 Jun 201807:14	–	veracode