graph.generator20 (>=1.0.0, <=1.0.2) potentially affected by CVE-2017-16047 via mysqljs (0.0.2-security)

mysqljs NPM version 0.0.2-security is affected by a known vulnerability. The following packages have a transitive dependency on mysqljs and may be impacted: - graph.generator20 =1.0.0, =1.0.2 Source cves: CVE-2017-16047 Source advisory: OSV:GHSA-8GV6-G7VP-HR34...

CVE-2017-16047

mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16047

CVE-2017-16047 corresponds to the mysqljs npm package, which is described across multiple sources as malware that steals environment variables and exfiltrates them to attacker-controlled locations. The core issue is that the package behaved as a malicious module, and all versions have been unpubl...