CVE-2017-16070

nodecaffe is a malware package published to hijack environment variables and exfiltrate them to attacker-controlled locations. The npm-hosted module has been unpublished across all versions. Affected context from the provided documents shows malware behavior and cleanup guidance: remove the packa...

CVE-2017-16065

CVE-2017-16065 corresponds to the npm malware incident involving the package named openssl.js, which was published to hijack environment variables and exfiltrate them to attacker-controlled locations. The linked records confirm that the package has been unpublished from the npm registry and that ...

CVE-2017-16057

The CVE-2017-16057 entry concerns the nodemssql npm package, which is documented as malware that steals environment variables and exfiltrates them to attacker-controlled locations. All versions have been unpublished from the npm registry. Impact described in linked advisories includes credential ...

CVE-2017-16056

CVE-2017-16056 refers to the npm package mssql.js , reported as a malicious module designed to hijack environment variables. The available connected sources confirm that this package steals credentials from environment variables and exfiltrates them to attacker-controlled locations, and that all ...

CVE-2017-16080: Embedded Malicious Code

nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

PT-2018-6085

Name of the Vulnerable Software and Affected Versions: nodemssql versions all Description: The nodemssql package is a piece of malware designed to steal environment variables and send them to attacker-controlled locations. All versions of this package have been unpublished from the npm registry. ...

CVE-2017-16075: Embedded Malicious Code

http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16064: Embedded Malicious Code

node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16069: Embedded Malicious Code

nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16070: Embedded Malicious Code

nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16079: Embedded Malicious Code

smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16063: Embedded Malicious Code

node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16059: Embedded Malicious Code

mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16067: Embedded Malicious Code

node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16071: Embedded Malicious Code

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16074: Embedded Malicious Code

crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16076: Embedded Malicious Code

proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16065: Embedded Malicious Code

openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16066: Embedded Malicious Code

opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16081: Embedded Malicious Code

cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...