Description

The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

Remediation

References

https://nodesecurity.io/advisories/544

Related Vulnerabilities

CVE-2020-10719 Vulnerability in maven package io.undertow:undertow-core

CVE-2014-3651 Vulnerability in maven package org.keycloak:keycloak-services

CVE-2021-23380 Vulnerability in npm package roar-pidusage

CVE-2023-26144 Vulnerability in npm package graphql

CVE-2020-7639 Vulnerability in npm package @eivifj/dot

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory