What is GHSA-7wgh-5q4q-6wx5?

GHSA-7wgh-5q4q-6wx5 is a security advisory published by GitHub Security Advisories with Critical severity. Malicious Package in 1337qq-js

Why does GHSA-7wgh-5q4q-6wx5 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-7wgh-5q4q-6wx5?

GHSA-7wgh-5q4q-6wx5 affects 1 product, including: npm/1337qq-js:\u003e= 0.0.0.

GHSA-7wgh-5q4q-6wx5CriticalDisclosed before NVD

Malicious Package in 1337qq-js

Vendor

GitHub Security Advisories

Published

September 4, 2020

Last Modified

January 9, 2023

📋 Description

All versions of 1337qq-js contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes:

Environment variables
Running processes
/etc/hosts
uname -a
npmrc file

Recommendation

Remove the package from your system and rotate any compromised credentials.

🎯 Affected products1

npm/1337qq-js:>= 0.0.0

🔗 References (2)

https://www.npmjs.com/advisories/1455
https://github.com/advisories/GHSA-7wgh-5q4q-6wx5