Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xMmhtLWd4M2YtaDYzcc4AAuAZ

Backdoor / Malicious code

lita-coin 0.0.3 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contained a backdoor mechanism that allowed the attacker to send a cookie file back to a compromised project, and allow the attacker to execute malicious commands.

Permalink: https://github.com/advisories/GHSA-q2hm-gx3f-h63q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xMmhtLWd4M2YtaDYzcc4AAuAZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 3 years ago
Updated: over 1 year ago

Widthdrawn: about 3 years ago

Identifiers: GHSA-q2hm-gx3f-h63q
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-15224
• https://www.zdnet.com/article/backdoor-code-found-in-11-ruby-libraries/
• https://github.com/advisories/GHSA-q2hm-gx3f-h63q

Blast Radius: 0.0

Affected Packages