PT-2018-19173 · Npm · Eslint-Scope

Publicado 2018-07-12 · Atualizado 2018-07-12

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions eslint-scope version 3.7.2

Description The issue concerns malicious code in a specific version of eslint-scope. This code reads the user's .npmrc file and sends any found authentication tokens to remote servers.

Recommendations Revoke all npm tokens to mitigate the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-506

Identificadores relacionados

GHSA-HXXF-Q3W9-4XGW

Produtos afetados

Eslint-Scope

Referências · 7

• https://github.com/eslint/eslint-scope · Nota
• https://github.com/eslint/eslint-scope/issues/39 · Nota
• https://github.com/advisories/GHSA-hxxf-q3w9-4xgw · Nota
• https://osv.dev/vulnerability/GHSA-hxxf-q3w9-4xgw · Aviso do Fabricante
• https://snyk.io/vuln/SNYK-JS-ESLINTSCOPE-11120 · Nota
• https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes · Nota
• https://npmjs.com/advisories/673 · Nota