8415 matches found
CVE-2017-16052
The CVE-2017-16052 entry concerns the npm package node-fabric, identified in multiple security advisories as malware that steals environment variables. Affected component: the node-fabric package (typo-squatting/malicious behavior) published to npm and later unpublished by npm. Root cause/attack ...
CVE-2017-16048
The CVE-2017-16048 entry covers the node-sqlite package, identified as malware that hijacks environment variables. Connected advisories confirm that the malware steals environment variables and exfiltrates to attacker-controlled locations; all versions were unpublished from npm. Practical impact ...
CVE-2017-16046
mariadb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16054
nodefabric was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16050
sqlite.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
CVE-2017-16053
The CVE-2017-16053 issue involves the npm package fabric-js , published as malware intended to hijack environment variables. Several connected sources (GHSA advisory, npm advisory, and CVE records) confirm that all versions were unpublished from the npm registry and that the malware steals enviro...
CVE-2017-16049
The CVE-2017-16049 case corresponds to the npm package nodesqlite, described across multiple sources as malware that steals environment variables and exfiltrates them to attacker-controlled locations. The core issue is malicious code published in nodesqlite intended to hijack environment variable...
CVE-2017-16046
CVE-2017-16046 corresponds to a malware incident involving the npm package name mariadb, which hijacked environment variables. The malware was published as a malicious module and all versions were unpublished from npm. Several connected sources indicate the issue affected the mariadb package and ...
airbrake module information disclosure vulnerability
The airbrake module is an exception report notification program for use in Node.js. A security vulnerability exists in airbrake module version 0.3.8 and earlier, which stems from the program defaulting to sending environment variables with sensitive values over the HTTP protocol. An attacker can...
Hardcoded credentials
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending...
CVE-2016-10530
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending...
CVE-2016-10530
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending...
CVE-2016-10530
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending...
node-tkinter information disclosure vulnerability
node-tkinter is a malware that steals environment variables and sends them to attackers. A security vulnerability exists in node-tkinter. An attacker can use this vulnerability to steal environment variables and send them to an address under the attacker's control...
mysqljs Information Disclosure Vulnerability
mysqljs is a malware that steals environment variables and sends them to an attacker. A security vulnerability exists in mysqljs. The vulnerability can be exploited by an attacker to steal environment variables and send them to an address under the attacker's control...
tkinter Information Disclosure Vulnerability
tkinter is a malware that steals environment variables and sends them to attackers. A security vulnerability exists in tkinter. An attacker can exploit the vulnerability to steal environment variables and send them to an address under the attacker's control...
Malicious Typo-Squatting
The node-tkinter packages is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake them for the real one but have malicious actions under the hood such as stealing environment variables...
Malicious Typo-Squatting
The tkinter packages is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake them for the real one but have malicious actions under the hood such as stealing environment variables...
Malicious Typo-Squatting
The mysqljs packages is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake them for the real one but have malicious actions under the hood such as stealing environment variables...