Malicious Package Affecting coffe-script package, versions *
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.17% (55th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:coffe-script:20171006
- published 9 Oct 2017
- disclosed 2 Aug 2017
- credit Aurélio A. Heckert
Introduced: 2 Aug 2017
Malicious CVE-2017-16203 Open this link in a new tabHow to fix?
Avoid usage of this package altogether.
Overview
coffe-script
is a malicious package that uses typosquatting to bait unknowing users to install them.
Packages like this, which carry similar names to an original package, offer all the functionality of their original, but also include a code snippet that sends your SSH keys and bash profile to a remote server controlled by malicious operators when installing it.
This is especially dangerous in production runtime environments, where environment variables tend to consist of keys, passwords, tokens and other secrets.
CVSS Scores
version 3.1