GHSA-2hqf-qqmq-pgpp

Source

https://github.com/advisories/GHSA-2hqf-qqmq-pgpp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-2hqf-qqmq-pgpp/GHSA-2hqf-qqmq-pgpp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2hqf-qqmq-pgpp

Published

2020-09-02T15:48:16Z

Modified

2021-10-01T13:30:38Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Malicious Package in commander-js

Details

All versions of commander-js are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads an arbitrary file and executes its contents as a post-install script.

Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.

Database specific

{
    "cwe_ids": [
        "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:34:51Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
}

References

https://www.npmjs.com/advisories/763

Affected packages

npm / commander-js

Package

Name: commander-js; View open source insights on deps.dev
Purl: pkg:npm/commander-js

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-2hqf-qqmq-pgpp/GHSA-2hqf-qqmq-pgpp.json"