GHSA-5x8q-gj67-rhf2

Source

https://github.com/advisories/GHSA-5x8q-gj67-rhf2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-5x8q-gj67-rhf2/GHSA-5x8q-gj67-rhf2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5x8q-gj67-rhf2

Published

2020-09-02T21:18:33Z

Modified

2021-09-30T21:23:24Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Malicious Package in discord_debug_log

Details

All versions of discord_debug_log contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.

Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.

Database specific

{
    "cwe_ids":  [
        "CWE-506"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:38:59Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

https://www.npmjs.com/advisories/873

Affected packages

npm / discord_debug_log

Package

Name: discord_debug_log; View open source insights on deps.dev
Purl: pkg:npm/discord_debug_log

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-5x8q-gj67-rhf2/GHSA-5x8q-gj67-rhf2.json"