8416 matches found
Design/Logic Flaw
cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16067
node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16069
nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16070
nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16063
node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16059
CVE-2017-16059 relates to the npm package mssql-node , identified as malware that steals environment variables and exfiltrates them to attacker-controlled locations. The linked advisories corroborate that all versions were unpublished from npm. The vulnerability’s concrete details in connected do...
CVE-2017-16066
opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16080
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16056
mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16079
smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16071
CVE-2017-16071 concerns the npm package nodemailer-js , described as malware that hijacks environment variables and exfiltrates them to attacker-controlled locations. All versions were unpublished from the npm registry. Connected advisories corroborate malware behavior and provide remediation gui...
CVE-2017-16058
CVE-2017-16058 corresponds to the npm package gruntcli, which was a malicious module designed to hijack environment variables. Multiple connected sources confirm that gruntcli behaved as malware, stealing environment variables and transmitting them to attacker-controlled locations; all versions h...
CVE-2017-16077
CVE-2017-16077 concerns the npm package named mongose, described across multiple sources as malware that steals environment variables and exfiltrates them to attacker-controlled locations. The package was unpublished from the npm registry, and advisories emphasize removal from affected environmen...
CVE-2017-16076
CVE-2017-16076 refers to the npm package proxy.js, described as malware that hijacks environment variables. The connected advisories confirm that proxy.js was published to steal env vars and that all versions were unpublished from the npm registry. Exploitation details are not provided in the doc...
CVE-2017-16072
CVE-2017-16072 concerns the nodemailer.js package, which is identified as malware that steals environment variables. The npm package was published with malicious intent and has since been unpublished from the npm registry. Connected advisories and records describe the malware behavior and recomme...
CVE-2017-16079
CVE-2017-16079 corresponds to the npm malware package described as the public smb package; it hijacked environment variables and exfiltrated them to attacker-controlled locations. All versions were unpublished from the npm registry. Connected records (GhSA/NVD/Veracode/OpenVAS) confirm the malwar...
CVE-2017-16080
CVE-2017-16080 relates to the npm package nodesass, identified as malware that steals environment variables and exfiltrates them to attacker-controlled locations. The npm registry has unpublished all versions of this package, mitigating ongoing use. Connected advisories (GHSA-xfmw-2vmm-579c, npm ...
CVE-2017-16077
mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...