Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-zu7y-rk6j-f3dn

Summary

Malicious Package
All versions of `sdfjghlkfjdshlkjdhsfg` contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version. ## Recommendation

Remove the package from your environment and ensure all packages owned were not impacted.

Aliases

alias	GHSA-gcfc-mgg3-8j2c

alias	GMS-2020-502

Fixed_packages

Affected_packages

url pkg:npm/sdfjghlkfjdshlkjdhsfg@0.0.0

purl pkg:npm/sdfjghlkfjdshlkjdhsfg@0.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-zu7y-rk6j-f3dn

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sdfjghlkfjdshlkjdhsfg@0.0.0

url pkg:npm/sdfjghlkfjdshlkjdhsfg@0.0.1-security

purl pkg:npm/sdfjghlkfjdshlkjdhsfg@0.0.1-security

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-zu7y-rk6j-f3dn

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sdfjghlkfjdshlkjdhsfg@0.0.1-security

References

reference_url

https://www.npmjs.com/advisories/1072

reference_id

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	CRITICAL
scoring_system	generic_textual
scoring_elements

url

https://www.npmjs.com/advisories/1072

reference_url

https://github.com/advisories/GHSA-gcfc-mgg3-8j2c

reference_id

GHSA-gcfc-mgg3-8j2c

reference_type

scores

value	CRITICAL
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-gcfc-mgg3-8j2c

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	506
name	Embedded Malicious Code
description	The product contains code that appears to be malicious in nature.

Exploits

Severity_range_score 9.0 - 10.0

Exploitability 0.5

Weighted_severity 9.0

Risk_score 4.5

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zu7y-rk6j-f3dn

Vulnerability Instance