GHSA-MC9X-V9XG-25PM coffescript is malware

🗓️ 06 Aug 2018 20:12:54Reported by GoogleType

osv🔗 osv.dev👁 13 Views

The 'coffescript' package is malware that steals sensitive data, including SSH keys and bash history, and sends it to attacker-controlled locations. All versions have been unpublished from the npm registry. Recommendations include deleting the package, clearing npm cache, and regenerating sensitive credentials

Reporter	Title	Published	Views	Family All 9
CVE	CVE-2017-16205	7 Jun 201802:00	–	cve
Cvelist	CVE-2017-16205	7 Jun 201802:00	–	cvelist
EUVD	EUVD-2018-0412	7 Oct 202500:30	–	euvd
Github Security Blog	coffescript is malware	6 Aug 201820:12	–	github
Node.js	Exfiltrates data on installation	4 Oct 201723:28	–	nodejs
NVD	CVE-2017-16205	7 Jun 201802:29	–	nvd
OpenVAS	Malicious JavaScript Package Detection	12 Jun 201800:00	–	openvas
Prion	Information disclosure	7 Jun 201802:29	–	prion
Veracode	Malicious Typo-Squatting	8 Jun 201803:27	–	veracode