GHSA-m36m-x4c5-rjxj

Source

https://github.com/advisories/GHSA-m36m-x4c5-rjxj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-m36m-x4c5-rjxj/GHSA-m36m-x4c5-rjxj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m36m-x4c5-rjxj

Published

2020-09-01T19:01:58Z

Modified

2020-08-31T18:27:21Z

Summary

Silently Runs Cryptocoin Miner in hooka-tools

Details

Affected versions of hooka-tools were compromised and modified to silently run a cryptocoin miner in the background.

All affected versions have been unpublished from the npm registry.

Recommendation

While this module has been unpublished, some versions may exist in mirrors or caches. Do not install this module, and remove it if found.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:27:21Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

https://www.npmjs.com/advisories/549

Affected packages

npm / hooka-tools

Package

Name: hooka-tools; View open source insights on deps.dev
Purl: pkg:npm/hooka-tools

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-m36m-x4c5-rjxj/GHSA-m36m-x4c5-rjxj.json"