Code injection

gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16071

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Design/Logic Flaw

noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Code injection

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Code injection

mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16064

node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Design/Logic Flaw

openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Code injection

ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Code injection

nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16066

opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16067

node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16079

CVE-2017-16079 corresponds to the npm malware package described as the public smb package; it hijacked environment variables and exfiltrated them to attacker-controlled locations. All versions were unpublished from the npm registry. Connected records (GhSA/NVD/Veracode/OpenVAS) confirm the malwar...

CVE-2017-16080

CVE-2017-16080 relates to the npm package nodesass, identified as malware that steals environment variables and exfiltrates them to attacker-controlled locations. The npm registry has unpublished all versions of this package, mitigating ongoing use. Connected advisories (GHSA-xfmw-2vmm-579c, npm ...

CVE-2017-16072

CVE-2017-16072 concerns the nodemailer.js package, which is identified as malware that steals environment variables. The npm package was published with malicious intent and has since been unpublished from the npm registry. Connected advisories and records describe the malware behavior and recomme...

CVE-2017-16070

nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16071

CVE-2017-16071 concerns the npm package nodemailer-js , described as malware that hijacks environment variables and exfiltrates them to attacker-controlled locations. All versions were unpublished from the npm registry. Connected advisories corroborate malware behavior and provide remediation gui...

CVE-2017-16077

CVE-2017-16077 concerns the npm package named mongose, described across multiple sources as malware that steals environment variables and exfiltrates them to attacker-controlled locations. The package was unpublished from the npm registry, and advisories emphasize removal from affected environmen...

CVE-2017-16076

CVE-2017-16076 refers to the npm package proxy.js, described as malware that hijacks environment variables. The connected advisories confirm that proxy.js was published to steal env vars and that all versions were unpublished from the npm registry. Exploitation details are not provided in the doc...

CVE-2017-16077

mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16063

node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...