GHSA-hxxf-q3w9-4xgw Malicious Package in eslint-scope
A malicious version of the eslint-scope npm package steals authentication tokens from .npmrc files, requiring immediate token revocation and package removal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-hxxf-q3w9-4xgw?
GHSA-hxxf-q3w9-4xgw is a vulnerability in eslint-config-eslint, published on 12 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Version 3.7.2 of eslint-scope was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to 2 remote servers.
Recommendation
The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Which versions are affected by GHSA-hxxf-q3w9-4xgw?
4 open source packages ship an affected version, including eslint-config-eslint and eslint-scope.
| Package | Affected | Fixed in |
|---|---|---|
eslint-config-eslint npm | From 5.0.2 | 6.0.0 |
eslint-config-eslint npm | From 5.0.2 | 6.0.0 |
eslint-scope npm | From 3.7.2 | 3.7.3 |
eslint-scope npm | From 3.7.2 | 3.7.3 |
How do I fix GHSA-hxxf-q3w9-4xgw?
Upgrade eslint-config-eslint to 6.0.0 or later.
Is GHSA-hxxf-q3w9-4xgw being exploited?
There is no known exploitation of GHSA-hxxf-q3w9-4xgw in the wild and no public exploit code.