fd-api-integration (>=0.0.2, <=0.0.9) potentially affected by CVE-2017-16055 via sqlserver (1.0.2)

sqlserver NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlserver and may be impacted: - fd-api-integration =0.0.2, =0.0.9 Source cves: CVE-2017-16055 Source advisory: OSV:GHSA-3RH7-VM4X-Q2HP...

CVE-2017-16055

sqlserver was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16055

CVE-2017-16055 corresponds to the npm package sqlserver, a malware module published to hijack environment variables. Connected sources confirm the malicious behavior (steals env vars and exfiltrates to attacker-controlled locations) and note that all versions have been unpublished from npm. The N...