5212 matches found
CVE-2017-16078
CVE-2017-16078 concerns the npm package shadow sock—described in connected advisories as a malware that steals environment variables and exfiltrates to attacker-controlled endpoints. The npm advisory and GitHub/OSV entries confirm it has been unpublished from the npm registry; all versions are re...
CVE-2017-16074
The CVE-2017-16074 entry concerns the npm package crossenv, which is described in connected documents as malware that hijacks environment variables and exfiltrates them to attacker-controlled locations. All versions have been unpublished from npm. Public advisories (GitHub GHSA and npm advisory) ...
CVE-2017-16073
noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16070
nodecaffe is a malware package published to hijack environment variables and exfiltrate them to attacker-controlled locations. The npm-hosted module has been unpublished across all versions. Affected context from the provided documents shows malware behavior and cleanup guidance: remove the packa...
CVE-2017-16064
node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16072
nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
Malicious Typo-Squatting
D3.js was a malicious module as it is developed to hijack environment variables and send it to attacker’s controlled location...
Malicious Module
nodefabric was a malicious module as it is developed to hijack environment variables...
Malicious Module
node-sqlite was a malicious module as it is developed to hijack environment variables and send it to attacker's controlled location...
Malicious Typo-Squatting
fabric-js is a malicious typo-squatter package. The packages uses a similar name to a legitimate library so that developers may mistake it for the real one but executes malicious actions under the hood such as stealing environment variables upon installation...
Malicious Typo-Squatting
sqlite.js is a malicious typo-squatters. The package uses a similar name to another library so that developers may mistake it for a legitimate package but executes malicious actions under the hood such as stealing environment variables on installation...
Malicious Typo-Squatting
mariadb is a malicious typo-squatted package. The package uses a similar name to another library so that developers may mistake it for a legitimate package but executes malicious actions under the hood such as stealing environment variables on installation...
Malicious Typo-Squatting
sqlserver is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake them for the real one but have malicious actions under the hood such as stealing environment variables...
Malicious Typo-Squatting
node-fabric is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake them for the real one but have malicious actions under the hood such as stealing environment variables...
Malicious Typo-Squatting
nodesqlite is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake them for the real one but have malicious actions under the hood such as stealing environment variables...
Malicious Typo-Squatting
jquery.js is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake them for the real one but have malicious actions under the hood such as stealing environment variables...
CVE-2017-16053
fabric-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16048
node-sqlite was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...