GHSA-9hc2-w9gg-q6jw Malicious Package in boogeyman
Malicious npm package steals SSH keys and npm tokens by executing remote payloads, requiring immediate credential rotation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-9hc2-w9gg-q6jw?
GHSA-9hc2-w9gg-q6jw is a vulnerability in boogeyman, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of boogeyman are considered malicious. This particular package would download a payload from pastebin.com, eval it to read ssh keys and the users .npmrc and send them to a private pastebin account.
Recommendation
This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate your ssh keys and your npm token.
Which versions are affected by GHSA-9hc2-w9gg-q6jw?
2 open source packages ship an affected version, including boogeyman.
| Package | Affected | Fixed in |
|---|---|---|
boogeyman npm | From 0.0.0 | None |
boogeyman npm | From 0.0.0 | None |
How do I fix GHSA-9hc2-w9gg-q6jw?
No fix has been published for GHSA-9hc2-w9gg-q6jw yet. Limit exposure of the affected software until one is available.
Is GHSA-9hc2-w9gg-q6jw being exploited?
There is no known exploitation of GHSA-9hc2-w9gg-q6jw in the wild and no public exploit code.