GHSA-C2M4-W5HM-VQJW crossenv is malware

The crossenv package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security concer...

@spectrellc/specscript-complier (>=0.0.1 <=0.1.2), maltodextrin (=1.0.0) +1 more potentially affected by CVE-2017-16074 via crossenv (=0.0.2-security)

crossenv NPM version =0.0.2-security is affected by a known vulnerability. The following packages have a transitive dependency on crossenv and may be impacted: - @spectrellc/specscript-complier =0.0.1, =2.0.0, =2.2.0 Source cves: CVE-2017-16074 Source advisory: OSV:GHSA-C2M4-W5HM-VQJW...

Unspecified vulnerability in crossenv

crossenv is a module for setting and using environment variables that supports several platforms. A security vulnerability exists in crossenv. An attacker can exploit this vulnerability to steal environment variables...

Malicious JavaScript Package Detection

Detection and reporting of known malicious JavaScript packages or package versions. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

CVE-2017-16074

crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Code injection

crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16074

The CVE-2017-16074 entry concerns the npm package crossenv, which is described in connected documents as malware that hijacks environment variables and exfiltrates them to attacker-controlled locations. All versions have been unpublished from npm. Public advisories (GitHub GHSA and npm advisory) ...

CVE-2017-16074

crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...