Malicious Package Affecting coffescript package, versions *
Snyk CVSS
Attack Complexity
Low
User Interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.17% (54th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:coffescript:20171006
- published 9 Oct 2017
- disclosed 2 Aug 2017
- credit Aurélio A. Heckert
Introduced: 2 Aug 2017
Malicious CVE-2017-16205 Open this link in a new tabHow to fix?
Avoid usage of this package altogether.
Overview
coffescript is a malicious package that uses typosquatting to bait unknowing users to install them.
Packages like this, which carry similar names to an original package, offer all the functionality of their original, but also include a code snippet that sends your SSH keys and bash profile to a remote server controlled by malicious operators when installing it.
This is especially dangerous in production runtime environments, where environment variables tend to consist of keys, passwords, tokens and other secrets.