Version 3.7.2 of eslint-scope was compromised (npm token stealer). Other versions are not flagged as malicious.
Do not install eslint-scope 3.7.2
HIGHanalyst verified
Npm token stealer. Added to CyberXYZ 2018-07-12, verified by a CyberXYZ analyst.
// what we observed
Compromised version published by attacker who got access via eslint maintainer account. Steals npm tokens from ~/.npmrc and sends to attacker server.
exfil target
pastebin
attack vector
compromised_maintainer
// versions and what to do
Malicious
3.7.2
Move to
3.7.3 newest 3.x release, no known advisory
9.1.2 current release, no known advisory
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss
9.1
critical
CVSS v3.1 base score out of 10
epss
not scored
chance of exploitation in 30 days
xyz score
5.2
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-hxxf-q3w9-4xgw, the advisory selected below
// 1 advisories
GHSA-hxxf-q3w9-4xgw
CRITICALGitHub rating
Version 3.7.2 of eslint-scope was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to 2 remote servers.