GitHub Advisoryadvisory · npm

GHSA-8hq2-fcqm-39hq Malicious Package in rimrafall

CRITICAL Published 2020-09-02 Modified 2021-09-30 Official page ↗
Ecosystem
npm
Packages
rimrafall
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-506
Reviewed
2020-08-31

Affected packages

• npm rimrafall: all versions (no fix yet)

Description

Version 1.0.0 of `rimrafall` contains malicious code as a preinstall script. The package attempts to remove all files in the system's root folder. Recommendation If you installed this package it is likely your machine was erased. If not, remove the package from your system and verify if any files were deleted.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References