GitHub Advisoryadvisory · npm

GHSA-p62r-jf56-h429 Malicious Package in evil-package

CRITICAL Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
evil-package
Severity
Critical
Weaknesses
CWE-506
Reviewed
2020-08-31

Affected packages

• npm evil-package: >= 0.0.0 (no fix yet)

Description

All versions of `evil-package` contain malicious code. The package uploads the contents of `process.env` to `example.com/log`. Recommendation Remove the package from your environment. Given the host where the information was uploaded to there is no further indication of compromise.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References