GHSA-hxxf-q3w9-4xgw
Malicious Package in eslint-scope
- Severity
- 9.1 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-506 Embedded Malicious Code
- Fix
- Available
- 2 packages have a fixed version
Description
Version 3.7.2 of eslint-scope was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to 2 remote servers.
Recommendation
The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| eslint-config-eslint | >= 5.0.2, < 6.0.0 |
6.0.0 |
| eslint-scope | >= 3.7.2, < 3.7.3 |
3.7.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
eslint-config-eslint npm → 6.0.0
- npm
npm install eslint-config-eslint@6.0.0- yarn
yarn add eslint-config-eslint@6.0.0- pnpm
pnpm add eslint-config-eslint@6.0.0
eslint-scope npm → 3.7.3
- npm
npm install eslint-scope@3.7.3- yarn
yarn add eslint-scope@3.7.3- pnpm
pnpm add eslint-scope@3.7.3
Severity breakdown
CVSS 3.1 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it
- Implementation, Operation: Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2026-48027 Compromised Nx Console version 18.95.0 | Critical Known exploited | Same weakness, CWE-506 |
| CVE-2026-8398 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from… | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-g7cv-rxg3-hmpx Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-5mg7-485q-xm76 Two LiteLLM versions published containing credential harvesting malware | Critical | Same weakness, CWE-506 |
| GHSA-69fq-xp46-6x23 Trivy ecosystem supply chain was briefly compromised | Critical Known exploited | Same weakness, CWE-506 |
| CVE-2025-59374 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain… | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-pxx3-g568-hxr4 color-convert@3.1.1 contains malware after npm account takeover | High | Same weakness, CWE-506 |
| GHSA-5fvm-p68v-5wmh color-name@2.0.1 contains malware after npm account takeover | High | Same weakness, CWE-506 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor