PT-2020-21120

Name of the Vulnerable Software and Affected Versions test-module-a versions all versions Description The issue concerns malicious code in the preinstall script of the affected software, which attempts to hijack packages by adding another maintainer to every package owned by the user. It is...

Malicious Package in 8.9.4

Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of 8.9.4 contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server. Recommendation Remove the package from your environment. There is no evidence of further compromise at the moment...

GHSA-725F-3PW7-RQ6X Malicious Package in 8.9.4

Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of 8.9.4 contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server. Recommendation Remove the package from your environment. There is no evidence of further compromise at the moment...

Malicious Package in ember_cli_babe

Version 6.16.0 of emberclibabe contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a...

GHSA-F7G4-FM4C-54M9 Malicious Package in yeoman-genrator

Version 2.0.2 of yoeman-generator contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a...

Malicious Package in log-symboles

Version 2.1.0 of log-symboles contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoo...

GHSA-QFC9-X7GV-27JR Malicious Package in deasyncp

All versions of deasyncp contain malicious code. The package shuts down the machine upon installation as a preinstall script. Recommendation Remove the package from your environment. There is no further compromise...

Malicious Package in deasyncp

All versions of deasyncp contain malicious code. The package shuts down the machine upon installation as a preinstall script. Recommendation Remove the package from your environment. There is no further compromise...

Malicious Package in sdfjghlkfjdshlkjdhsfg

All versions of sdfjghlkfjdshlkjdhsfg contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version. Recommendation Remove the package from your environment and ensure all...

Malicious Package in m-backdoor

All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM. Recommendation Remove the...

GHSA-VV52-3MRP-455M Malicious Package in m-backdoor

All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM. Recommendation Remove the...

PT-2020-21530

Name of the Vulnerable Software and Affected Versions m-backdoor affected versions not specified Description The issue concerns malicious code within the m-backdoor package, which downloads and executes a file from a remote server as a preinstall script. This script has been observed to deface...

PT-2020-21107

Name of the Vulnerable Software and Affected Versions SoftwareX version 8.9.4 Description The issue concerns malicious code in the preinstall script of the package, which reads the system's SSH keys but does not upload them to a remote server. Recommendations Remove the package from your...

PT-2020-21266

Name of the Vulnerable Software and Affected Versions yoeman-generator version 2.0.2 Description The issue concerns malicious code in the preinstall script of the package. This malware is designed to exploit users who make typos when installing modules. Upon installation, it downloads a file from...

PT-2020-21459

Name of the Vulnerable Software and Affected Versions deasyncp versions affected versions not specified Description The issue concerns malicious code within the deasyncp package, which causes the machine to shut down upon installation due to a preinstall script. Recommendations Remove the package...

Malicious Package in rimrafall

Version 1.0.0 of rimrafall contains malicious code as a preinstall script. The package attempts to remove all files in the system's root folder. Recommendation If you installed this package it is likely your machine was erased. If not, remove the package from your system and verify if any files...

GHSA-8HQ2-FCQM-39HQ Malicious Package in rimrafall

Version 1.0.0 of rimrafall contains malicious code as a preinstall script. The package attempts to remove all files in the system's root folder. Recommendation If you installed this package it is likely your machine was erased. If not, remove the package from your system and verify if any files...

Malicious Package in tensorplow

All versions of tensorplow contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secret...

GHSA-QJ3G-WFR7-3CV7 Malicious Package in require-ports

Version 10.4.0 of require-ports contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a...

Malicious Package in logsymbles

Version 2.2.0 of logsymbles contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...