CVE-2023-49210

The CVE-2023-49210 entry concerns the openssl (node-openssl) NPM package up to version 2.0.0. A root cause is that the package’s opts argument contains a verb field that can be passed to exec, enabling arbitrary command execution. Multiple sources (Red Hat, Veracode, GHSA, OSV) describe this as a...

CVE-2017-16064

The CVE refers to the npm malware node-openssl, a malicious module published to hijack environment variables. Multiple sources confirm that the package stole environment variables and exfiltrated them to attacker-controlled locations, and that all versions have been unpublished from the npm regis...