GHSA-QMJG-G86H-6RC9 d3.js is malware

🗓️ 23 Jul 2018 21:00:28Reported by GoogleType

osv🔗 osv.dev👁 22 Views

The 'd3.js' package is a piece of malware stealing environment variables and sending them to attacker-controlled locations, leading to unpublishing from the npm registry. Recommendations include deleting the package, clearing npm cache, checking other package.json files, regenerating registry credentials, and reviewing services for exposure

Reporter	Title	Published	Views	Family All 10
CVE	CVE-2017-16044	4 Jun 201819:00	–	cve
Cvelist	CVE-2017-16044	4 Jun 201819:00	–	cvelist
EUVD	EUVD-2018-0313	7 Oct 202500:30	–	euvd
Github Security Blog	d3.js is malware	23 Jul 201821:00	–	github
Node.js	Hijacked Environment Variables	8 Aug 201721:46	–	nodejs
NVD	CVE-2017-16044	4 Jun 201819:29	–	nvd
OpenVAS	Malicious JavaScript Package Detection	12 Jun 201800:00	–	openvas
Prion	Code injection	4 Jun 201819:29	–	prion
Veracode	Malicious Typo-Squatting	5 Jun 201808:02	–	veracode
vulnersOsv	maltodextrin (=1.0.0), sk-stand (=0.2.12) +2 more potentially affected by CVE-2017-16044 via d3.js (=0.0.2-security)	23 Jul 201821:00	–	vulnersosv