Weakness (CWE)
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it (1 mitigation)
-
Implementation, Operation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
Source: MITRE CWE-506
459 results · Feed
-
Critical 9.8
Malicious Package in smartsearchwp
All versions of `smartsearchwp` contain malicious code. The package is malware intended to steal credentials from websites it is loaded in. It traverses DOM elements looking for fields such as `username` and `password` and uploads it to a remote server. The p…
-
Critical —
Malicious Package in m-backdoor
All versions of `m-backdoor` contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly …
-
Critical 9.8
Malicious Package in maleficent
All versions of `maleficent` contain malicious code. The package is a demonstration of possible risks when installing npm packages. It gathers system information such as: environment variables, OS information, network interface, AWS credentials, npm credentia…
-
Critical 9.8
Malicious Package in vue-backbone
Version 0.1.2 of `vue-backbone` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the…
-
Critical 9.8
Malicious Package in font-scrubber
Version 1.2.2 of `font-scrubber` contains malicious code as a postinstall script. The package attempts to upload sensitive files from the system to a remote server. The files include configuration files, command history logs, SSH keys and /etc/passwd. ## Reco…
-
Critical 9.8
Malicious Package in rimrafall
Version 1.0.0 of `rimrafall` contains malicious code as a preinstall script. The package attempts to remove all files in the system's root folder. ## Recommendation If you installed this package it is likely your machine was erased. If not, remove the package…
-
Critical 9.8
Malicious Package in yeoman-genrator
Version 3.1.1 of `yeoman-genrator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a rem…
-
Critical 9.8
Malicious Package in uglyfi-js
Version 3.4.6 of `uglyfi-js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote se…
-
Critical 9.8
Malicious Package in tensorplow
All versions of `tensorplow` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands. ## Recommendation Any computer that has this package installed or running should …
-
Critical 9.8
Malicious Package in require-ports
Version 10.4.0 of `require-ports` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remo…
-
Critical 9.8
Malicious Package in logsymbles
Version 2.2.0 of `logsymbles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote s…
-
Critical 9.8
Malicious Package in jquerz
Version 1.0.1 of `jquerz` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote serve…
-
Critical 9.8
Malicious Package in jqeury
Version 3.3.1 of `jqeury` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote serve…
-
Critical 9.8
Malicious Package in hulp
All versions of `hulp` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands. ## Recommendation Any computer that has this package installed or running should be con…
-
Critical 9.8
Malicious Package in froever
All versions of `froever` contain malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server…
-
Critical 9.8
Malicious Package in colour-string
Version 1.5.3 of `colour-string` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be consid…
-
Critical 9.8
Malicious Package in colro-name
Version 9.0.0 of `colro-name` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be considere…
-
Critical 9.8
Malicious Package in browserift
Version 16.3.3 of `browserift` contained malicious code as a preinstall script. The package was a backdoor that opened a connection to a remote server and executed incoming commands on both Unix and Windows machines ## Recommendation Any computer that has thi…
-
Critical 9.8
Malicious Package in bowe
Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be considered ful…
-
Critical 9.8
Malicious Package in whiteproject
All versions of `whiteproject` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remove the …
-
Critical 9.8
Malicious Package in bowee
Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be considered ful…
-
Critical 9.8
Malicious Package in saync
All versions of `saync ` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in reqest
All versions of `reqest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in destroyer-of-worlds
The package `destroyer-of-worlds` contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop.…
-
Critical 9.8
Malicious Package in donotinstallthis
The package `donotinstallthis` contained malicious code. The package contained a script that was run as part of the install script. The script contacted a remote service tracking how many installations were done. There is no further compromise. ## Recommendat…
-
Critical 9.8
Malicious Package in carloprojectdiscord
All versions of `carloprojectdiscord` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remo…
-
Critical 9.8
Malicious Package in discord_debug_log
All versions of `discord_debug_log` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remove…
-
Critical 9.8
Malicious Package in carloprojectlesang
All versions of `carloprojectlesang` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remov…
-
Critical 9.8
Malicious Package in erquest
All versions of `erquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in rqeuest
All versions of `rqeuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in requset
All versions of `requset` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in requets
All versions of `requets` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in requet
All versions of `requet` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in rrequest
All versions of `rrequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in reques
All versions of `reques` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in reequest
All versions of `reequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in reqquest
All versions of `reqquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in requuest
All versions of `requuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in requeest
All versions of `requeest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…
-
Critical 9.8
Malicious Package in requesst
All versions of `requesst` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, t…