Skip to content

ffmepg is malware

High severity GitHub Reviewed Published Aug 29, 2018 to the GitHub Advisory Database • Updated Sep 7, 2023

Package

npm ffmepg (npm)

Affected versions

<= 1.0.2

Patched versions

None

Description

The ffmepg package is a piece of malware that steals environment variables and sends them to attacker controlled locations.

All versions have been unpublished from the npm registry.

Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there.

If you have found this installed in your environment, you should:

  1. Delete the package
  2. Clear your npm cache
  3. Ensure it is not present in any other package.json files on your system
  4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables.

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.

References

Published to the GitHub Advisory Database Aug 29, 2018
Reviewed Jun 16, 2020
Last updated Sep 7, 2023

Severity

High
7.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CVE ID

CVE-2017-16068

GHSA ID

GHSA-3wxq-7r8m-qpmg

Source code

No known source code
Checking history
See something to contribute? Suggest improvements for this vulnerability.