CVE-2017-16073: Hijacked Environment Variables in noderequest
Summary
CVE-2017-16073: noderequest is malware. Affects noderequest versions < 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The noderequest package is a npm package that provides functionality for making HTTP requests in Node.js. It is vulnerable to a hijacking attack where environment variables are stolen and sent to attacker-controlled locations.
Vulnerability Detail
The noderequest package has been identified as a piece of malware that steals environment variables and sends them to attacker-controlled locations. This can lead to the compromise of sensitive information such as credentials and tokens. All versions of the package have been unpublished from the npm registry. The severity of this vulnerability is considered moderate.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The noderequest package has been identified as malware that steals environment variables. If you have this package installed, it is important to take immediate action to remove it, clear your npm cache, regenerate credentials, and review any exposed services. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for noderequest →
FAQ
The noderequest package is an npm package that provides functionality for making HTTP requests in Node.js.
This vulnerability allows an attacker to steal environment variables, which can include sensitive information such as credentials and tokens.
To fix this vulnerability, you need to delete the noderequest package, clear your npm cache, remove any traces of the package from other package.json files, regenerate your credentials, and review any exposed services for compromise.
No, there is no known workaround for this vulnerability. It is recommended to follow the steps mentioned in the 'How to Fix' section.
This vulnerability is considered moderate in severity.
