Advisory details:
github_osv / GHSA-7cgc-fjv4-52x6
| Advisory ID | github_osv/GHSA-7cgc-fjv4-52x6 |
| Aliases | |
| Summary | Malware in pre-build binaries of bignum ### Impact bignum releases from v0.12.2 to v0.13.0 (inclusive) used node-pre-gyp to optionally download pre-built binary versions of the addon. These binaries were published on a now-expired S3 bucket which has since been claimed by a malicious third party which is now serving binaries containing malware that exfiltrates data from the user's computer. ### Patches v0.13.1 does not use node-pre-gyp and does not have support for downloading pre-built binaries in any form, avoiding the risk of malicious downloads. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-506 | Embedded Malicious Code |
| System | Score | Found at |
|---|---|---|
| generic_textual | CRITICAL |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.