GitHub Advisoryadvisory · npm

GHSA-mfc2-93pr-jf92 Malicious code in `loadyaml`

CRITICAL Published 2020-10-01 Modified 2020-10-01 Official page ↗
Ecosystem
npm
Packages
loadyaml
Severity
Critical
Weaknesses
CWE-506
Reviewed
2020-10-01

Affected packages

• npm loadyaml: <= 1.0.2 (no fix yet)

Description

npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information: • IP and IP-based geolocation • home directory name • local username The malicious packages have been removed from the npm registry and the leaked content removed from GitHub.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References