GHSA-m852-866j-69j8 Malicious Package in eslint-config-airbnb-standard
A malicious npm package exfiltrates user credentials from .npmrc files, requiring immediate token revocation and package replacement.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-m852-866j-69j8?
GHSA-m852-866j-69j8 is a vulnerability in eslint-config-airbnb-standard, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Version 2.0.0 of eslint-config-airbnb-standard was published with a bundled version of eslint-scope that was found to contain malicious code. This code would read the users .npmrc file and send it's contents to a remote server.
Recommendation
The best course of action if you found this package installed in your environment is to revoke all your npm tokens and use a different version of the module. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Which versions are affected by GHSA-m852-866j-69j8?
2 open source packages ship an affected version, including eslint-config-airbnb-standard.
| Package | Affected | Fixed in |
|---|---|---|
eslint-config-airbnb-standard npm | From 2.0.0 | 2.1.0 |
eslint-config-airbnb-standard npm | From 2.0.0 | 2.1.0 |
How do I fix GHSA-m852-866j-69j8?
Upgrade eslint-config-airbnb-standard to 2.1.0 or later.
Is GHSA-m852-866j-69j8 being exploited?
There is no known exploitation of GHSA-m852-866j-69j8 in the wild and no public exploit code.