CVE-2017-16079

CVE-2017-16079 corresponds to the npm malware package described as the public smb package; it hijacked environment variables and exfiltrated them to attacker-controlled locations. All versions were unpublished from the npm registry. Connected records (GhSA/NVD/Veracode/OpenVAS) confirm the malwar...

CVE-2017-16067

node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16080

nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16079

smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16077

mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16076

CVE-2017-16076 refers to the npm package proxy.js, described as malware that hijacks environment variables. The connected advisories confirm that proxy.js was published to steal env vars and that all versions were unpublished from the npm registry. Exploitation details are not provided in the doc...

CVE-2017-16071

CVE-2017-16071 concerns the npm package nodemailer-js , described as malware that hijacks environment variables and exfiltrates them to attacker-controlled locations. All versions were unpublished from the npm registry. Connected advisories corroborate malware behavior and provide remediation gui...

CVE-2017-16074

crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16056

mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16058

gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16069

nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16070

nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16056

CVE-2017-16056 refers to the npm package mssql.js , reported as a malicious module designed to hijack environment variables. The available connected sources confirm that this package steals credentials from environment variables and exfiltrates them to attacker-controlled locations, and that all ...

CVE-2017-16073

CVE-2017-16073 concerns the npm package “noderequest,” a malware module published to hijack environment variables. The provided sources confirm that noderequest was designed to steal environment variables and exfiltrate data to attacker-controlled locations, and that all versions were unpublished...

CVE-2017-16075

CVE-2017-16075 corresponds to the http-proxy.js package that was published as malware with the intent to hijack environment variables and exfiltrate them to attacker-controlled locations. The npm advisory and related records note that all versions were unpublished from the npm registry. Connected...

CVE-2017-16066

CVE-2017-16066 corresponds to opencv.js, a malicious npm module published to hijack environment variables. The vulnerability was acknowledged across multiple sources (NVD, ENISA, GHSA, osv) with the module unpublished by npm. Affected content specifies a malware intent affecting the runtime envir...

CVE-2017-16076

proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16078

CVE-2017-16078 concerns the npm package shadow sock—described in connected advisories as a malware that steals environment variables and exfiltrates to attacker-controlled endpoints. The npm advisory and GitHub/OSV entries confirm it has been unpublished from the npm registry; all versions are re...

CVE-2017-16078

shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16070

nodecaffe is a malware package published to hijack environment variables and exfiltrate them to attacker-controlled locations. The npm-hosted module has been unpublished across all versions. Affected context from the provided documents shows malware behavior and cleanup guidance: remove the packa...