CVE-2017-16127

描述

The `pandora-doomsday` package is a malicious package that adds itself to the package.json of other packages discovered on the victim host and attempts to publish the package. It has been removed from the npm registry. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

如何修補 CVE-2017-16127

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2017-16127 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 0.0.0

CVSS 分數

參考連結(2)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-16127
• WEBwww.npmjs.com/advisories/482