GitHub Advisoryadvisory · npm

GHSA-73hr-6785-f5p8 Malicious Package in donotinstallthis

CRITICAL Published 2020-09-02 Modified 2021-09-30 Official page ↗
Ecosystem
npm
Packages
donotinstallthis
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-506
Reviewed
2020-08-31

Affected packages

• npm donotinstallthis: all versions (no fix yet)

Description

The package `donotinstallthis` contained malicious code. The package contained a script that was run as part of the install script. The script contacted a remote service tracking how many installations were done. There is no further compromise. Recommendation Remove the package from your environment.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References