d3.js is malware

Description

The d3.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations.

All versions have been unpublished from the npm registry.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.2

References

• GHSA-qmjg-g86h-6rc9
• www.npmjs.com
• CVE-2017-16044
• CWE-506
• CAPEC-310
• OWASP 2021-A6

Related Issues

• openssl.js is malware - CVE-2017-16065
• opencv.js is malware - CVE-2017-16066
• Moderate severity vulnerability that affects marked - CVE-2017-17461
• Regular Expression Denial of Service in debug - CVE-2017-16137

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

d3.js