Malicious Package

Overview loadyaml was removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information: - IP and IP-based geolocation - home directory name - local username Recommendatio...

PT-2020-20984

Name of the Vulnerable Software and Affected Versions loadyaml affected versions not specified electorn affected versions not specified Description The issue concerns malicious code in npm packages. Upon installation, the packages run a preinstall script that writes a public comment on GitHub,...

PT-2020-21401

Name of the Vulnerable Software and Affected Versions loadyaml affected versions not specified electorn affected versions not specified Description The issue concerns malicious code in npm packages. Upon installation, the packages run a preinstall script that exposes sensitive information,...

Malicious Package in test-module-a

All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you own any...

GHSA-76XQ-58HJ-VWM2 Malicious Package in test-module-a

All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you own any...

PT-2020-21120

Name of the Vulnerable Software and Affected Versions test-module-a versions all versions Description The issue concerns malicious code in the preinstall script of the affected software, which attempts to hijack packages by adding another maintainer to every package owned by the user. It is...

Malicious Package in 8.9.4

Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of 8.9.4 contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server. Recommendation Remove the package from your environment. There is no evidence of further compromise at the moment...

GHSA-725F-3PW7-RQ6X Malicious Package in 8.9.4

Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of 8.9.4 contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server. Recommendation Remove the package from your environment. There is no evidence of further compromise at the moment...

Malicious Package in ember_cli_babe

Version 6.16.0 of emberclibabe contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a...

GHSA-F7G4-FM4C-54M9 Malicious Package in yeoman-genrator

Version 2.0.2 of yoeman-generator contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a...

Malicious Package in log-symboles

Version 2.1.0 of log-symboles contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoo...

GHSA-QFC9-X7GV-27JR Malicious Package in deasyncp

All versions of deasyncp contain malicious code. The package shuts down the machine upon installation as a preinstall script. Recommendation Remove the package from your environment. There is no further compromise...

Malicious Package in deasyncp

All versions of deasyncp contain malicious code. The package shuts down the machine upon installation as a preinstall script. Recommendation Remove the package from your environment. There is no further compromise...

Malicious Package in sdfjghlkfjdshlkjdhsfg

All versions of sdfjghlkfjdshlkjdhsfg contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version. Recommendation Remove the package from your environment and ensure all...

Malicious Package in m-backdoor

All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM. Recommendation Remove the...

GHSA-VV52-3MRP-455M Malicious Package in m-backdoor

All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM. Recommendation Remove the...

PT-2020-21530

Name of the Vulnerable Software and Affected Versions m-backdoor affected versions not specified Description The issue concerns malicious code within the m-backdoor package, which downloads and executes a file from a remote server as a preinstall script. This script has been observed to deface...

PT-2020-21107

Name of the Vulnerable Software and Affected Versions SoftwareX version 8.9.4 Description The issue concerns malicious code in the preinstall script of the package, which reads the system's SSH keys but does not upload them to a remote server. Recommendations Remove the package from your...

PT-2020-21266

Name of the Vulnerable Software and Affected Versions yoeman-generator version 2.0.2 Description The issue concerns malicious code in the preinstall script of the package. This malware is designed to exploit users who make typos when installing modules. Upon installation, it downloads a file from...

PT-2020-21459

Name of the Vulnerable Software and Affected Versions deasyncp versions affected versions not specified Description The issue concerns malicious code within the deasyncp package, which causes the machine to shut down upon installation due to a preinstall script. Recommendations Remove the package...