CVE-2017-16206

CVE-2017-16206 corresponds to the npm package cofee-script, which is malware that exfiltrates sensitive data (notably a user’s private SSH key and bash history) to attacker-controlled locations during installation. Publicly reported details across multiple Connected documents confirm that all ver...

CVE-2017-16203

The CVE-2017-16203 entry concerns the coffe-script npm package, which (per multiple sources) exfiltrates sensitive data (e.g., private SSH keys and bash history) to attacker-controlled locations during installation. Affected behavior is the package’s malware-like activity; all versions have been ...

CVE-2017-16205

CVE-2017-16205 relates to the coffescript npm package, described as malware that exfiltrates sensitive data (notably a user’s private SSH key and bash history) to attacker-controlled locations during installation. The companion advisories consistently warn that all versions have been unpublished ...