PT-2018-19173 · Npm · Eslint-Scope

Published 2018-07-12 · Updated 2018-07-12

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions eslint-scope version 3.7.2

Description The issue concerns malicious code in a specific version of eslint-scope. This code reads the user's .npmrc file and sends any found authentication tokens to remote servers.

Recommendations Revoke all npm tokens to mitigate the issue.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

GHSA-HXXF-Q3W9-4XGW

Affected Products

Eslint-Scope

References · 7

• https://osv.dev/vulnerability/GHSA-hxxf-q3w9-4xgw · Vendor Advisory
• https://github.com/eslint/eslint-scope · Note
• https://github.com/eslint/eslint-scope/issues/39 · Note
• https://github.com/advisories/GHSA-hxxf-q3w9-4xgw · Note
• https://snyk.io/vuln/SNYK-JS-ESLINTSCOPE-11120 · Note
• https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes · Note
• https://npmjs.com/advisories/673 · Note