What is GHSA-hxxf-q3w9-4xgw?

GHSA-hxxf-q3w9-4xgw is a security advisory published by GitHub Security Advisories with Critical severity. Malicious Package in eslint-scope

Why does GHSA-hxxf-q3w9-4xgw have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-hxxf-q3w9-4xgw?

GHSA-hxxf-q3w9-4xgw has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-hxxf-q3w9-4xgw?

GHSA-hxxf-q3w9-4xgw affects 2 products, including: npm/eslint-scope:= 3.7.2; npm/eslint-config-eslint:= 5.0.2.

GHSA-hxxf-q3w9-4xgwCriticalCVSS 9.1Disclosed before NVD

Malicious Package in eslint-scope

Vendor

GitHub Security Advisories

Published

July 12, 2018

Last Modified

July 7, 2023

📋 Description

Version 3.7.2 of eslint-scope was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to 2 remote servers.

Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens

🎯 Affected products2

npm/eslint-scope:= 3.7.2
npm/eslint-config-eslint:= 5.0.2

🔗 References (5)

https://github.com/eslint/eslint-scope/issues/39
https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes
https://github.com/advisories/GHSA-hxxf-q3w9-4xgw
https://www.npmjs.com/advisories/673
https://snyk.io/vuln/SNYK-JS-ESLINTSCOPE-11120