openssl.js is malware

Description

The openssl.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations.

All versions have been unpublished from the npm registry.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.0.0

References

• GHSA-22gq-x6pg-752j
• www.npmjs.com
• CVE-2017-16065
• CWE-433
• CWE-506
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Code Injection in cryo - CVE-2018-3784
• Open Redirect in urijs - CVE-2022-0868
• Code Injection in mosc - CVE-2020-7672
• Code Injection in jsen - CVE-2020-7777

Tags:

npm

openssl.js