CWE-506
Allowed-with-ReviewEmbedded Malicious Code
Abstraction: Class · Status: Incomplete
The product contains code that appears to be malicious in nature.
548 vulnerabilities reference this CWE, most recent first.
GHSA-VXFP-QMPQ-6826
Vulnerability from github – Published: 2020-09-03 17:38 – Updated: 2021-09-30 19:46All versions of hpmm contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.
Recommendation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "hpmm"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:45:36Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `hpmm` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-vxfp-qmpq-6826",
"modified": "2021-09-30T19:46:35Z",
"published": "2020-09-03T17:38:09Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1053"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in hpmm"
}
GHSA-W37P-236H-PFX3
Vulnerability from github – Published: 2026-05-07 00:52 – Updated: 2026-06-08 23:12Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions
Published: 2026-04-30
Last Updated: 2026-05-12
Github Advisory: CVE-2026-44484
We have identified a security incident affecting certain versions of one of our PyPI packages.
What happened
We have determined that one or more released versions of this package have been compromised and include malicious code.
Our current investigation indicates that the affected versions have introduced functionality consistent with a credential harvesting mechanism. We are still actively analysing the scope and behaviour of the code.
At this stage, the root cause of the compromise is still under investigation.
What versions are affected
We are currently working to confirm the exact set of impacted versions.
We have determined the following versions as affected and ask that you delete them from your systems:
2.6.22.6.3
We will update this advisory if the versions impacted by this vulnerability change.
What you should do immediately
If you have installed or are running any potentially affected versions:
- Assume the environment may be compromised
- Immediately rotate all credentials and secrets that may have been exposed, including:
- API keys
- Access tokens
- SSH keys
- Service account credentials
- Rebuild affected systems from a known clean state
- Pin PyTorch Lightning to version
2.6.1 - Review logs for any suspicious or unauthorised activity
Actions we have taken
- Quarantined malicious versions from PyPI
- Recommend using version
2.6.1: https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.1 - Revoked and rotated all internal credentials associated with our release process
- Initiated a full investigation into the compromise
Ongoing investigation
We are actively working to:
- Identify the exact mechanism of compromise
- Confirm the full set of affected versions
- Determine the behaviour and impact of the malicious code
- Assess any downstream impact to users
We will provide updates as soon as more information becomes available.
Commitment to transparency
We take the security of our users and the integrity of our software supply chain extremely seriously.
We will continue to share timely and accurate updates as our investigation progresses.
Contact
If you have questions or believe you may be impacted, please contact us at:
security@lightning.ai
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pytorch-lightning"
},
"versions": [
"2.6.2"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pytorch-lightning"
},
"versions": [
"2.6.3"
]
}
],
"aliases": [
"CVE-2026-44484"
],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-07T00:52:55Z",
"nvd_published_at": "2026-05-14T15:16:48Z",
"severity": "CRITICAL"
},
"details": "# Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions\n\n**Published:** 2026-04-30 \n**Last Updated:** 2026-05-12 \n\n**Github Advisory:** [CVE-2026-44484](https://github.com/advisories/GHSA-w37p-236h-pfx3)\n\nWe have identified a security incident affecting certain versions of one of our PyPI packages.\n\n## What happened\n\nWe have determined that one or more released versions of this package have been compromised and include malicious code.\n\nOur current investigation indicates that the affected versions have introduced functionality consistent with a credential harvesting mechanism. We are still actively analysing the scope and behaviour of the code.\n\nAt this stage, the root cause of the compromise is still under investigation.\n\n## What versions are affected\n\nWe are currently working to confirm the exact set of impacted versions.\n\nWe have determined the following versions as affected and ask that you delete them from your systems:\n\n- `2.6.2`\n- `2.6.3`\n\nWe will update this advisory if the versions impacted by this vulnerability change.\n\n## What you should do immediately\n\nIf you have installed or are running any potentially affected versions:\n\n- Assume the environment may be compromised \n- Immediately rotate all credentials and secrets that may have been exposed, including: \n - API keys \n - Access tokens \n - SSH keys \n - Service account credentials \n- Rebuild affected systems from a known clean state \n- Pin PyTorch Lightning to version `2.6.1` \n- Review logs for any suspicious or unauthorised activity \n\n## Actions we have taken\n\n- Quarantined malicious versions from PyPI \n- Recommend using version `2.6.1`: https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.1 \n- Revoked and rotated all internal credentials associated with our release process \n- Initiated a full investigation into the compromise \n\n## Ongoing investigation\n\nWe are actively working to:\n\n- Identify the exact mechanism of compromise \n- Confirm the full set of affected versions \n- Determine the behaviour and impact of the malicious code \n- Assess any downstream impact to users \n\nWe will provide updates as soon as more information becomes available.\n\n## Commitment to transparency\n\nWe take the security of our users and the integrity of our software supply chain extremely seriously.\n\nWe will continue to share timely and accurate updates as our investigation progresses.\n\n## Contact\n\nIf you have questions or believe you may be impacted, please contact us at:\n\n**security@lightning.ai**",
"id": "GHSA-w37p-236h-pfx3",
"modified": "2026-06-08T23:12:39Z",
"published": "2026-05-07T00:52:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Lightning-AI/pytorch-lightning/security/advisories/GHSA-w37p-236h-pfx3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44484"
},
{
"type": "PACKAGE",
"url": "https://github.com/Lightning-AI/pytorch-lightning"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Compromise of PyTorch Lightning PyPi Package Versions"
}
GHSA-W3F3-4J22-2V3P
Vulnerability from github – Published: 2020-09-02 21:27 – Updated: 2021-09-30 21:25The package destroyer-of-worlds contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop. The script targeted UNIX systems.
Recommendation
Remove the package from your environment and perform additional incident response on your system's files and processes.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "destroyer-of-worlds"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:39:31Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "The package `destroyer-of-worlds` contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop. The script targeted UNIX systems.\n\n\n## Recommendation\n\nRemove the package from your environment and perform additional incident response on your system\u0027s files and processes.",
"id": "GHSA-w3f3-4j22-2v3p",
"modified": "2021-09-30T21:25:19Z",
"published": "2020-09-02T21:27:02Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/890"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in destroyer-of-worlds"
}
GHSA-W3PP-WP5V-FJVP
Vulnerability from github – Published: 2020-09-03 19:51 – Updated: 2021-09-30 20:20This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.
Recommendation
Remove the package from your environment. There are no indications of further compromise.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mogodb"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:48:27Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.\n\n\n## Recommendation\n\nRemove the package from your environment. There are no indications of further compromise.",
"id": "GHSA-w3pp-wp5v-fjvp",
"modified": "2021-09-30T20:20:19Z",
"published": "2020-09-03T19:51:18Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1133"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in mogodb"
}
GHSA-W62P-HX95-GF2C
Vulnerability from github – Published: 2025-09-09 14:39 – Updated: 2025-09-10 21:08The DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions. The following packages and versions are affected:
@duckdb/node-api@1.3.3@duckdb/node-bindings@1.3.3duckdb@1.3.3@duckdb/duckdb-wasm@1.29.2
Note: The current release version of DuckDB is 1.3.2, with 1.4.0 expected to be released on Sept 10th, 2025 (tomorrow as of this writing). We do not plan to ever release a “legit” DuckDB 1.3.3. Users should double-check that they are not accidentally updating to those affected versions.
We have ourselves noticed this within four hours of it happening. Here’s our response:
- As an immediate response, we have deprecated the specific versions.
- We have reached out to npm support to delete the affected versions. They were so kind to do so.
- We have also re-released the node packages with higher version numbers (1.3.4/1.30.0) as a further safeguard so the latest version of the package points to a safe version
We apologize for this issue. We are reviewing our internal processes to ensure the safety of future releases.
Postmortem
On September 8th (Monday), the DuckDB maintainers received the following message from "...@npmjs.help":
One of the maintainers read through this text and found it somewhat reasonable. He followed the link (now defunct) to a website hosted under the domain npmjs.help. This website contained a pixel-perfect copy of the npmjs.com website. He logged in using the duckdb_admin user and password, followed by 2FA. Again, the user profile, settings etc. were a perfect copy of the npmjs.com website including all user data. As requested by the email, he then re-set the 2FA setup.
In the background, the copycat website forwarded all actions to the actual npm website, so the 2FA was actually updated there, too. But they also added a new API token, which they then used to publish the malicious package versions. In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. It's painful to spell out, but we fell for a classic phishing attack.
We again apologize for this mishap. We are reviewing our internal processes to ensure the safety of future releases. It is fortunate that we noticed this within a few hours of it happening. The DuckDBLabs team was able to set up a call at 7AM to perform an immediate response. Fortunately we were not locked out of our NPM account, which also easily could have happened. We were able to rotate passwords, tokens and API keys immediately.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "duckdb"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.3"
},
{
"fixed": "1.3.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.3.3"
]
},
{
"package": {
"ecosystem": "npm",
"name": "@duckdb/node-api"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.3"
},
{
"fixed": "1.3.4-alpha.27"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.3.3"
]
},
{
"package": {
"ecosystem": "npm",
"name": "@duckdb/node-bindings"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.3"
},
{
"fixed": "1.3.4-alpha.27"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.3.3"
]
},
{
"package": {
"ecosystem": "npm",
"name": "@duckdb/duckdb-wasm"
},
"ranges": [
{
"events": [
{
"introduced": "1.29.2"
},
{
"fixed": "1.30.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.29.2"
]
}
],
"aliases": [
"CVE-2025-59037"
],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-09T14:39:14Z",
"nvd_published_at": "2025-09-09T21:15:39Z",
"severity": "HIGH"
},
"details": "The DuckDB distribution for [Node.js](http://node.js/) on [npm](https://www.npmjs.com/) was compromised with malware (along with [several other packages](https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised)). An attacker published new versions of four of duckdb\u2019s packages that included **malicious code to interfere with cryptocoin transactions**. The following packages and versions are affected:\n\n- `@duckdb/node-api@1.3.3`\n- `@duckdb/node-bindings@1.3.3`\n- `duckdb@1.3.3`\n- `@duckdb/duckdb-wasm@1.29.2`\n\n\u003e Note: The current release version of DuckDB is 1.3.2, with 1.4.0 expected to be released on Sept 10th, 2025 (tomorrow as of this writing). We do not plan to ever release a \u201clegit\u201d DuckDB 1.3.3. Users should double-check that they are not accidentally updating to those affected versions. \n\n\nWe have ourselves noticed this *within four hours* of it happening. Here\u2019s our response:\n\n- As an immediate response, we have **deprecated** the specific versions. \n- We have reached out to npm support to **delete the affected versions**. They were so kind to do so.\n- We have also **re-released** the node packages with higher version numbers (1.3.4/1.30.0) as a further safeguard so the latest version of the package points to a safe version\n\nWe apologize for this issue. We are reviewing our internal processes to ensure the safety of future releases.\n\n### Postmortem ###\n\nOn September 8th (Monday), the DuckDB maintainers received the following message from \"...@npmjs.help\":\n\n\u003cimg width=\"1134\" height=\"614\" alt=\"Screenshot 2025-09-09 at 11 07 09\" src=\"https://github.com/user-attachments/assets/0ce24798-1f5a-40b0-ac50-49035d99862b\" /\u003e\n\nOne of the maintainers read through this text and found it somewhat reasonable. He followed the link (now defunct) to a website hosted under the domain `npmjs.help`. This website contained a **pixel-perfect copy** of the [npmjs.com](http://npmjs.com/) website. He logged in using the `duckdb_admin` user and password, followed by 2FA. Again, the user profile, settings etc. were a perfect copy of the [npmjs.com](http://npmjs.com/) website including all user data. As requested by the email, he then re-set the 2FA setup. \n\nIn the background, the copycat website forwarded all actions to the actual npm website, so the 2FA was actually updated there, too. But they also added a new API token, which they then used to publish the malicious package versions. In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. It\u0027s painful to spell out, but **we fell for a classic phishing attack**.\n\nWe again apologize for this mishap. We are reviewing our internal processes to ensure the safety of future releases. It is fortunate that we noticed this within a few hours of it happening. The DuckDBLabs team was able to set up a call at 7AM to perform an immediate response. Fortunately we were not locked out of our NPM account, which also easily could have happened. We were able to rotate passwords, tokens and API keys immediately.",
"id": "GHSA-w62p-hx95-gf2c",
"modified": "2025-09-10T21:08:58Z",
"published": "2025-09-09T14:39:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59037"
},
{
"type": "PACKAGE",
"url": "https://github.com/duckdb/duckdb-node"
},
{
"type": "WEB",
"url": "https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4"
},
{
"type": "WEB",
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware"
}
GHSA-W65V-HX54-XRQX
Vulnerability from github – Published: 2020-09-03 17:41 – Updated: 2021-09-30 19:50All versions of midway-xtpl contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.
Recommendation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "midway-xtpl"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:45:45Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `midway-xtpl` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-w65v-hx54-xrqx",
"modified": "2021-09-30T19:50:35Z",
"published": "2020-09-03T17:41:23Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1057"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in midway-xtpl"
}
GHSA-W7WG-24G3-2C78
Vulnerability from github – Published: 2020-09-02 21:14 – Updated: 2021-09-30 20:29All versions of requset typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.
Recommendation
Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "requset"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:38:50Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `requset` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.\n\n\n## Recommendation\n\nRemove the package from your dependencies and always ensure package names are typed correctly upon installation.",
"id": "GHSA-w7wg-24g3-2c78",
"modified": "2021-09-30T20:29:47Z",
"published": "2020-09-02T21:14:17Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/869"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in requset"
}
GHSA-W8FH-PVQ2-X8C4
Vulnerability from github – Published: 2021-01-29 18:11 – Updated: 2021-01-29 18:10The npm sonatype package has been identified as malicious and removed from the npm package registry.
Remediation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sonatype"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2021-01-29T18:10:59Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "The npm `sonatype` package has been identified as malicious and removed from the npm package registry.\n\n## Remediation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-w8fh-pvq2-x8c4",
"modified": "2021-01-29T18:10:59Z",
"published": "2021-01-29T18:11:20Z",
"references": [
{
"type": "WEB",
"url": "https://blog.sonatype.com/sonatype-spots-more-discord-malware-in-npm?hs_preview=BbDPGbfh-40737456755"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1596"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Malicious npm package: sonatype"
}
GHSA-W8HG-MXVH-9H57
Vulnerability from github – Published: 2020-09-01 19:42 – Updated: 2021-09-24 14:49Version 0.0.9 of angular-bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=
Recommendation
If version 0.0.9 of this module is found installed you will want to replace it with a version before or after 0.0.9. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "angular-bmap"
},
"versions": [
"0.0.9"
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:29:57Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Version 0.0.9 of `angular-bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 0.0.9 of this module is found installed you will want to replace it with a version before or after 0.0.9. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.",
"id": "GHSA-w8hg-mxvh-9h57",
"modified": "2021-09-24T14:49:19Z",
"published": "2020-09-01T19:42:49Z",
"references": [
{
"type": "PACKAGE",
"url": "https://github.com/shenfw1987/angular-bmap"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-ANGULARBMAP-451017"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/614"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in angular-bmap"
}
GHSA-W9HW-V97W-G5F5
Vulnerability from github – Published: 2020-09-04 16:43 – Updated: 2021-10-01 20:43All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.
Recommendation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bitconi-ops"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:56:41Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-w9hw-v97w-g5f5",
"modified": "2021-10-01T20:43:23Z",
"published": "2020-09-04T16:43:14Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1368"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in bitconi-ops"
}
Mitigation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
CAPEC-442: Infected Software
An adversary adds malicious logic, often in the form of a computer virus, to otherwise benign software. This logic is often hidden from the user of the software and works behind the scenes to achieve negative impacts. Many times, the malicious logic is inserted into empty space between legitimate code, and is then called when the software is executed. This pattern of attack focuses on software already fielded and used in operation as opposed to software that is still under development and part of the supply chain.
CAPEC-448: Embed Virus into DLL
An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.
CAPEC-636: Hiding Malicious Data or Code within Files
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.