CVE-2017-16128

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-506CWE-276

Affected software

VendorProductVersions
HackerOnenpm-script-demo node moduleAll versions

References

Timeline

Published
Jun 7, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-161295.9The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed responsCVE-2017-16135.3IBM Connections 6.0 could allow an unauthenticated remote attacker to gain unauthenticated or unauthorized access to non-sensitive EngagemenCVE-2017-161307.5exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attackeCVE-2017-161317.5unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pCVE-2017-161327.5simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker accesCVE-2017-161337.5goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" CVE-2017-161347.5http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue, giving an attacker access to the fileCVE-2017-161357.5serverzyy is a static file server. serverzyy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plCVE-2017-161367.5method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesCVE-2017-161375.3The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes arCVE-2017-161387.5The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted useCVE-2017-161397.5jikes is a file server. jikes is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in
CVE-2017-16128: Critical severity, CVSS 9.8 | Vulnix