GitHub Advisoryadvisory · npm

GHSA-3cjv-4phw-gvvv Malicious Package in getcookies

CRITICAL Published 2020-09-01 Modified 2021-10-01 Official page ↗
Ecosystem
npm
Packages
getcookies
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-506
Reviewed
2020-08-31

Affected packages

• npm getcookies: all versions (no fix yet)

Description

The `getcookies` module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module. Recommendation This module should be uninstalled if found used within an application. In addition to removing the installed module, you will also want to evaluate your application to determine whether or not user data or systems were compromised.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References