PT-2020-21194 · Npm · Boogeyman
Published
2020-09-01
·
Updated
2020-09-01
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
boogeyman (affected versions not specified)
Description
The issue concerns a malicious package that downloads a payload from pastebin.com, evaluates it to read ssh keys and the user's
.npmrc file, and sends them to a private pastebin account.Recommendations
Revoke and rotate your ssh keys and your npm token if the
boogeyman package is found in your environment.Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Boogeyman