What is GHSA-gcfc-mgg3-8j2c?

GHSA-gcfc-mgg3-8j2c is a security advisory published by GitHub Security Advisories with Critical severity. Malicious Package in sdfjghlkfjdshlkjdhsfg

Why does GHSA-gcfc-mgg3-8j2c have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-gcfc-mgg3-8j2c?

GHSA-gcfc-mgg3-8j2c has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-gcfc-mgg3-8j2c?

GHSA-gcfc-mgg3-8j2c affects 1 product, including: npm/sdfjghlkfjdshlkjdhsfg:\u003e= 0.0.0.

GHSA-gcfc-mgg3-8j2cCriticalCVSS 9.8Disclosed before NVD

Malicious Package in sdfjghlkfjdshlkjdhsfg

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

January 9, 2023

📋 Description

All versions of sdfjghlkfjdshlkjdhsfg contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version.

Recommendation

Remove the package from your environment and ensure all packages owned were not impacted.

🎯 Affected products1

npm/sdfjghlkfjdshlkjdhsfg:>= 0.0.0

🔗 References (2)

https://www.npmjs.com/advisories/1072
https://github.com/advisories/GHSA-gcfc-mgg3-8j2c