Weakness (CWE)
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it (1 mitigation)
-
Implementation, Operation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
Source: MITRE CWE-506
459 results · Feed
-
Critical 9.8
Malicious Package in requestt
All versions of `requestt` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in calk
All versions of `calk` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the N…
-
Critical 9.8
Malicious Package in chak
All versions of `chak` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the N…
-
Critical 9.8
Malicious Package in eact
All versions of `eact` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the N…
-
Critical 9.8
Malicious Package in experss
All versions of `experss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in commnader
All versions of `commnader` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, …
-
Critical 9.8
Malicious Package in exprss
All versions of `exprss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in momen
All versions of `momen` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the …
-
Critical 9.8
Malicious Package in aysnc
All versions of `aysnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the …
-
Critical 9.8
Malicious Package in asnyc
All versions of `asnyc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the …
-
Critical 9.8
Malicious Package in asycn
All versions of `asycn` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the …
-
Critical 9.8
Malicious Package in asnc
All versions of `asnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the N…
-
Critical 9.8
Malicious Package in aasync
All versions of `aasync` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in asyync
All versions of `asyync` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in asynnc
All versions of `asynnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in asymc
All versions of `asymc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the …
-
Critical 9.8
Malicious Package in asinc
All versions of `asinc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the …
-
Critical 9.8
Malicious Package in wepack-cli
All versions of `wepack-cli` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package,…
-
Critical 9.8
Malicious Package in jajajejejiji
All versions of `jajajejejiji` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended packag…
-
Critical 9.8
Malicious Package in 4equest
All versions of `4equest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in portionfatty12
All versions of `portionfatty12` are considered malicious. The package is malware designed to steal user's data. When installed it uploads the user's public SSH keys to a remote server. ## Recommendation This package is not available on the npm Registry anymo…
-
Critical 9.8
Malicious Package in rrgod
All versions of `rrgod` are considered malicious. The package is malware designed to run arbitrary scripts. When installed, the package downloads an arbitrary file and executes its contents as a pre, post and install scripts. ## Recommendation This package is…
-
Critical 9.8
Malicious Package in commander-js
All versions of `commander-js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads an arbitrary file and executes its contents…
-
Critical 9.8
Entropy Backdoor in text-qrcode
All versions of `text-qrcode` contain malicious code that overwrites the `randomBytes` method for the `crypto` module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and ha…
-
Critical 9.8
Malicious Package in flatmap-stream
Version 0.1.1 of `flatmap-stream` is considered malicious. This module runs an encrypted payload targeting a very specific application, `copay` and because they shared the same description it would have likely worked for `copay-dash`. The injected code: - Rea…
-
Critical 9.8
Malicious Package in foever
All versions of `foever` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitr…
-
Critical 9.8
Malicious Package in soket.js
All versions of `soket.js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbi…
-
Critical 9.8
Malicious Package in soket.io
All versions of `soket.io` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbi…
-
Critical 9.8
Malicious Package in regenraotr
All versions of `regenraotr` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute ar…
-
Critical 9.8
Malicious Package in regenrator
All versions of `regenrator` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute ar…
-
Critical 9.8
Malicious Package in axois
All versions of `axois` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitra…
-
Critical 9.8
Malicious Package in boogeyman
All versions of `boogeyman` are considered malicious. This particular package would download a payload from pastebin.com, eval it to read ssh keys and the users `.npmrc` and send them to a private pastebin account. ## Recommendation This package was published…
-
Critical 9.8
Malicious Package in eslint-config-airbnb-standard
Version 2.0.0 of `eslint-config-airbnb-standard` was published with a bundled version of `eslint-scope` that was found to contain malicious code. This code would read the users `.npmrc` file and send it's contents to a remote server. ## Recommendation The bes…
-
Critical 9.8
Malicious Package in ladder-text-js
`ladder-text-js` contained a malicious script that attempted to delete all files when `npm test` was run. ## Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
-
Critical 9.8
Malicious Package in nothing-js
`nothing-js` contained a malicious script that attempted to delete all files when `npm test` was run. ## Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
-
Critical 9.8
Malicious Package in getcookies
The `getcookies` module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module. ## Recommendation This module should be uninstalled if found used within an application. In addition …
-
Critical 9.8
Malicious Package in nginxbeautifier
Version 1.0.14 of `nginxbeautifier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If versio…
-
Critical 9.8
Malicious Package in json-serializer
Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If versio…
-
Critical 9.8
Malicious Package in freshdom
Version 0.0.6 of `freshdom` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.6 …
-
Critical 9.8
Malicious Package in impala
Version 1.1.7 of `impala` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.1.7 of…