CVE-2017-16205: Exfiltration of Sensitive Data in coffescript
Summary
CVE-2017-16205: coffescript is malware. Affects coffescript versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The coffescript package is a popular JavaScript framework that compiles into JavaScript. It is used to enhance the readability and maintainability of JavaScript code by providing syntactic sugar and additional features. However, a vulnerability has been discovered in the coffescript package that allows an attacker to exfiltrate sensitive data during installation.
Vulnerability Detail
The coffescript package has been found to contain malware that steals sensitive data, including a user's private SSH key and bash history. This data is then sent to locations controlled by the attacker. The package has been unpublished from the npm registry to prevent further installations. If coffescript is found in your environment, it is recommended to delete the package, clear your npm cache, ensure it is not present in any other package.json files, and regenerate your SSH keys and other sensitive credentials. Any services exposed via credentials in your bash history or accessible through your SSH keys should also be reviewed for compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The coffescript package has been found to contain malware that exfiltrates sensitive data. If you have this package installed, it is crucial to take immediate action by deleting the package, clearing your npm cache, and regenerating your SSH keys and other sensitive credentials. Review any services that may have been exposed through your compromised credentials. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for coffescript →
FAQ
The coffescript package is a JavaScript framework that compiles into JavaScript, providing syntactic sugar and additional features to enhance the readability and maintainability of JavaScript code.
The coffescript malware steals sensitive data such as a user's private SSH key and bash history, sending them to attacker-controlled locations.
You can check if coffescript is installed by running the command npm ls coffescript in your terminal.
If coffescript is found in your environment, you should delete the package, clear your npm cache, ensure it is not present in any other package.json files, and regenerate your SSH keys and other sensitive credentials.
To prevent this vulnerability, regularly update your packages and use reputable sources for package installations. Additionally, consider using vulnerability monitoring tools like Vulert to receive real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for coffescript.
