Malicious Package

🗓️ 15 Nov 2021 03:58:01Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 25 Views

npm is a malicious package as it does not properly match `package-lock.json` with `package.json

Reporter	Title	Published	Views	Family All 51
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)	28 Mar 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	12 Jan 202317:22	–	ibm
Tenable Nessus	Amazon Linux 2022 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2022-2022-048)	6 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : nodejs (ALAS2022-2022-214)	9 Dec 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-084)	21 Mar 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : nodejs:16 (ALSA-2022:4796)	6 Jun 202200:00	–	nessus
Tenable Nessus	CentOS 8 : nodejs:16 (CESA-2022:4796)	30 May 202200:00	–	nessus
Tenable Nessus	CentOS 9 : nodejs-16.16.0-1.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	MiracleLinux 8 : nodejs:16 (AXSA:2022-3781:01)	20 Jan 202600:00	–	nessus

Vulners

Node

npmjs npmMatch7.0.12+ds-1debian

AND

debian debian_linuxMatch999

npmjs npmMatch7.13.0-r0js

AND

npmjs npmMatch7.17.0-r0js

AND

npmjs npmMatch7.24.2-r0js

AND

npmjs npmMatch7.20.2-r0js

AND

npmjs npmMatch7.24.1-r0js

AND

npmjs npmMatch8.1.0-r0js

AND

npmjs npmMatch7.15.0-r0js

AND

npmjs npmMatch8.1.1-r0js

AND

npmjs npmMatch7.21.0-r0js

AND

npmjs npmMatch7.12.1-r0js

AND

npmjs npmMatch7.11.2-r0js

AND

npmjs npmMatch7.21.1-r0js

AND

npmjs npmMatch7.20.5-r0js

AND

npmjs npmMatch7.22.0-r0js

AND

npmjs npmMatch7.9.0-r2js

AND

npmjs npmMatch8.1.3-r0js

AND

npmjs npmMatch7.23.0-r0js

AND

npmjs npmMatch7.24.0-r0js

AND

npmjs npmMatch7.10.0-r0js

AND

alpinelinux alpine_linuxMatchedge

npmjs npmRange7.0.0-beta.0–8.4.0js

npmjs npmRange7.3.0–7.16.0js

Source	Link
docs	www.docs.npmjs.com/cli/v7/commands/npm-ci
github	www.github.com/npm/cli/issues/2701
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXNVFKOF5ZYH5NIRWHKN6O6UBCHDV6FE/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/NXNVFKOF5ZYH5NIRWHKN6O6UBCHDV6FE/
docs	www.docs.npmjs.com/cli/v8/commands/npm-ci
github	www.github.com/icatalina/CVE-2021-43616
github	www.github.com/npm/cli/commit/457e0ae61bbc55846f5af44afa4066921923490f
github	www.github.com/npm/cli/issues/2701
github	www.github.com/npm/cli/issues/2701
medium	www.medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0

04 Aug 2024 05:45Current

3Low risk

Vulners AI Score3

CVSS 3.19 - 9.8

CVSS 27.5

EPSS0.01851