Malicious Package in evil-package
Critical severity
GitHub Reviewed
Published
Sep 3, 2020
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Description
Reviewed
Aug 31, 2020
Published to the GitHub Advisory Database
Sep 3, 2020
Last updated
Jan 9, 2023
All versions of
evil-packagecontain malicious code. The package uploads the contents ofprocess.envtoexample.com/log.Recommendation
Remove the package from your environment. Given the host where the information was uploaded to there is no further indication of compromise.
References