GHSA-8mm3-2mcj-cx6r

Suggest an improvement
Source
https://github.com/advisories/GHSA-8mm3-2mcj-cx6r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-8mm3-2mcj-cx6r/GHSA-8mm3-2mcj-cx6r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8mm3-2mcj-cx6r
Published
2020-09-11T21:09:24Z
Modified
2021-09-30T21:57:57Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Malicious Package in angluar-cli
Details

Version 0.0.3 of angluar-cli contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus on macOS.

Recommendation

Remove the package from your environment and verify whether files were deleted and if processes were stopped.

Database specific 
{
    "cwe_ids":  [
        "CWE-506"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:40:31Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}
References

Affected packages

npm / angluar-cli

Package

Name
angluar-cli
View open source insights on deps.dev
Purl
pkg:npm/angluar-cli

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-8mm3-2mcj-cx6r/GHSA-8mm3-2mcj-cx6r.json"