GitHub Advisoryadvisory · npm

GHSA-8mm3-2mcj-cx6r Malicious Package in angluar-cli

CRITICAL Published 2020-09-11 Modified 2021-09-30 Official page ↗
Ecosystem
npm
Packages
angluar-cli
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-506
Reviewed
2020-08-31

Affected packages

• npm angluar-cli: all versions (no fix yet)

Description

Version 0.0.3 of `angluar-cli` contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus on macOS. Recommendation Remove the package from your environment and verify whether files were deleted and if processes were stopped.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References