What is GHSA-pv55-r6j3-wp94?

GHSA-pv55-r6j3-wp94 is a security advisory published by GitHub Security Advisories with Critical severity. Malicious Package in eslint-config-eslint

Why does GHSA-pv55-r6j3-wp94 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-pv55-r6j3-wp94?

GHSA-pv55-r6j3-wp94 affects 1 product, including: npm/eslint-config-eslint:= 5.0.2.

GHSA-pv55-r6j3-wp94CriticalDisclosed before NVD

Malicious Package in eslint-config-eslint

Vendor

GitHub Security Advisories

Published

September 1, 2020

Last Modified

July 27, 2023

📋 Description

Version 5.0.2 of eslint-config-eslint was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to a remote server.

Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens

Users may consider downgrading to version 5.0.1

🎯 Affected products1

npm/eslint-config-eslint:= 5.0.2

🔗 References (2)

https://www.npmjs.com/advisories/674
https://github.com/advisories/GHSA-pv55-r6j3-wp94