Weakness (CWE)
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it (1 mitigation)
-
Implementation, Operation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
Source: MITRE CWE-506
459 results · Feed
-
Critical 9.8
Malicious Package in import-mysql
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in file-logging
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in bs85
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bs58chekc
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bsae-x
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in body-parse-xml
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in cionstring
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstirng
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinpayment
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstrng
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstrig
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in colne
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in axioss
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in commandre
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in commanedr
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in conistring
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in crpyto-js
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in axios-http
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in crytpo-js
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in bb-builder
All versions of `bb-builder` contained malicious code. The package ran an executable targeting Windows and uploaded information to a remote server. ## Recommendation Any computer that has this package installed or running should be considered fully compromise…
-
Critical 9.8
Malicious Package in zemen
Version 0.0.5 of `zemen` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the package f…
-
Critical 9.8
Malicious Package in cal_rd
Version 0.1.1 of `rc_cal` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the package …
-
Critical 9.8
Malicious Package in anarchy
All versions of `anarchy` contain malicious code. The package ran `rm - rf /` as an install script. ## Recommendation Remove the package from your environment.
-
Critical 9.8
Malicious Package in fast-requests
All versions of `fast-requests` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remove the…
-
Critical 9.8
Malicious Package in cage-js
All versions of `cage-js` contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secr…
-
Critical 9.8
Malicious Package in rate-map
Version 1.0.3 of `rate-map` contains malicious code. The malware breaks functionality of the `purescript-installer` package by rewriting code of the `dl-tar` dependency. ## Recommendation Upgrade to version 1.0.5 or later. There is no indication of further co…
-
Critical 9.8
Malicious Package in load-from-cwd-or-npm
Version 3.0.2 of `load-from-cwd-or-npm` contains malicious code. The malware breaks functionality of the `purescript-installer` package by injecting targeted code. ## Recommendation Upgrade to version 3.0.4 or later. There is no indication of further compromi…
-
Critical 9.8
Malicious Package in nodes.js
All versions of `nodes.js ` contain malicious code. The package searches and installs globally thousands of packages based on keywords `node`, `react`, `react-native`, `vue`, `angular` and `babel` to fill the system's memory. ## Recommendation Remove the pack…
-
Critical 9.8
Malicious Package in deasyncp
All versions of `deasyncp ` contain malicious code. The package shuts down the machine upon installation as a preinstall script. ## Recommendation Remove the package from your environment. There is no further compromise.
-
Critical 9.8
Malicious Package in sdfjghlkfjdshlkjdhsfg
All versions of `sdfjghlkfjdshlkjdhsfg` contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version. ## Recommendation Remove the pac…
-
Critical 9.8
Malicious Package in tiar
All versions of `tiar` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All s…
-
Critical 9.8
Malicious Package in secure_identity_login_module
All versions of `secure_identity_login_module` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered …
-
Critical 9.8
Malicious Package in river-mock
All versions of `river-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…
-
Critical 9.8
Malicious Package in retcodelog
All versions of `retcodelog` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…
-
Critical 9.8
Malicious Package in qingting
All versions of `qingting` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. A…
-
Critical 9.8
Malicious Package in node-buc
All versions of `node-buc` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. A…
-
Critical 9.8
Malicious Package in midway-dataproxy
All versions of `midway-dataproxy` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compro…
-
Critical 9.8
Malicious Package in midway-xtpl
All versions of `midway-xtpl` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised…
-
Critical 9.8
Malicious Package in hsf-clients
All versions of `hsf-clients` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised…
-
Critical 9.8
Malicious Package in luna-mock
All versions of `luna-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. …