Description
The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
Remediation
References
https://nodesecurity.io/advisories/542
Related Vulnerabilities
CVE-2022-21803 Vulnerability in maven package org.webjars.npm:nconf
CVE-2019-16568 Vulnerability in maven package hudson.plugins.sctmexecutor:sctmexecutor
CVE-2018-3726 Vulnerability in npm package crud-file-server
CVE-2019-20174 Vulnerability in maven package org.webjars.npm:auth0-lock
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-flink-table