PT-2018-19174 · Npm · Flatmap-Stream+1
Published
2018-11-26
·
Updated
2018-11-26
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
event-stream versions 3.3.6
flatmap-stream (affected versions not specified)
Description
A malicious package
flatmap-stream was added as a dependency to the NPM event-stream package. This issue affects users of event-stream who have version 3.3.6. Users are advised to take action to mitigate the risk.Recommendations
For event-stream version 3.3.6, downgrade to version 3.3.4 or upgrade to the latest 4.x version.
For flatmap-stream, remove the dependency entirely.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Event-Stream
Flatmap-Stream