Malicious Node.js Module Affects npm Environment Variables
CVE-2017-16057

7.5HIGH

Key Information:

Vendor

Hackerone

Status
Nodemssql Node Module
Vendor
CVE Published:
7 June 2018

What is CVE-2017-16057?

The nodemssql module, identified as malicious, was designed to hijack environment variables within Node.js applications. This module has since been removed from npm to mitigate potential risks to developers and their applications. Users are advised to remain vigilant and review their dependencies for any malicious activities.

Affected Version(s)

nodemssql node module All versions

References

https://nodesecurity.io/advisories/484
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.