CVE-2017-16202: Vulnerability in cofeescript Package
Summary
CVE-2017-16202: cofeescript is malware. Affects cofeescript versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cofeescript package is a popular npm package used for compiling CoffeeScript code into JavaScript. It provides a convenient way for developers to write and maintain CoffeeScript projects. However, the package has been found to contain a piece of malware that exfiltrates sensitive data during installation. This includes a user's private SSH key and bash history, which are then sent to attacker-controlled locations. All versions of the package have been unpublished from the npm registry to prevent further exploitation.
Vulnerability Detail
The vulnerability in the cofeescript package allows an attacker to steal sensitive data from users' systems. When the package is installed, it initiates the exfiltration process, sending the user's private SSH key and bash history to the attacker's controlled locations. This can lead to unauthorized access to the user's systems, compromise of their credentials, and potential exposure of sensitive information. The malware is embedded within the package and executes its malicious activities during installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The cofeescript package has been found to contain a malware that exfiltrates sensitive data during installation. It is crucial to take immediate action if you have this package installed in your environment. Delete the package, clear your npm cache, regenerate your SSH keys, and review and update any compromised credentials. It is also recommended to review any services that may have been exposed and look for indicators of compromise. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for cofeescript →
FAQ
The cofeescript package is an npm package used for compiling CoffeeScript code into JavaScript. It simplifies the development process for CoffeeScript projects.
The cofeescript malware exfiltrates a user's private SSH key and bash history, sending them to attacker-controlled locations.
You can check if cofeescript is installed by running the command npm ls cofeescript in your project directory or by inspecting your package.json file.
If cofeescript is installed, you should delete the package, clear your npm cache, ensure it is not present in any other package.json files, regenerate your SSH keys, and review and update any other sensitive credentials that may have been compromised.
To prevent this vulnerability, it is important to regularly update your packages and be cautious when installing packages from untrusted sources. Additionally, consider using package vulnerability monitoring tools like Vulert to receive real-time alerts about vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for cofeescript.
