Malicious Package Affecting coffe-script package, versions *


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Mature
EPSS
0.17% (56th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDnpm:coffe-script:20171006
  • published9 Oct 2017
  • disclosed2 Aug 2017
  • creditAurélio A. Heckert

Introduced: 2 Aug 2017

Malicious CVE-2017-16203  (opens in a new tab)
CWE-506  (opens in a new tab)

How to fix?

Avoid usage of this package altogether.

Overview

coffe-script is a malicious package that uses typosquatting to bait unknowing users to install them. Packages like this, which carry similar names to an original package, offer all the functionality of their original, but also include a code snippet that sends your SSH keys and bash profile to a remote server controlled by malicious operators when installing it.

This is especially dangerous in production runtime environments, where environment variables tend to consist of keys, passwords, tokens and other secrets.

CVSS Scores

version 3.1