Malicious Package Affecting maleficent package, versions *
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Mature
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-MALEFICENT-455281
- published 24 Jul 2019
- disclosed 10 Jun 2019
- credit npm security
How to fix?
Avoid using maleficent altogether.
Overview
maleficent is not currently in use, but was formerly occupied by another package.
This package is malicious. It gathers system information such as: environment variables, OS information, network interface, AWS credentials, npm credentials and ssh keys. The package prints the information to a local file but does not upload it to a remote server.