DLL injection to coa

[blaky]

To facilitate future automation, please use the following format

Advisory details

  URL: https://github.com/veged/coa/issues/99
  format: npm
  namespace: N/A
  name: coa
  versions: 2.1.1, 2.1.3, 2.0.3, 2.0.4, 3.0.3,

More information
Please see veged/coa#99 , it looks like someone published a "new" version of this unmaintained library and added a trojan DLL that executes malicious code on Windows machines. Since then, the version was removed from the public NPM repository, but the package could be cached on NPM proxy Nexus servers.

[TKr]

there are also
2.1.1 and 2.0.4

veged/coa#101

[blaky]

More info on: GHSA-73qr-pfmq-6rp8

[ken-duck]

Thanks for the heads up. This has been added and should show in the public database by sometime tomorrow.