CVE-2019-19771

EUVD-2019-0794
The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Affected Products (NVD)
VendorProductVersion
lodahs_projectlodahs
1.0.0
𝑥
= Vulnerable software versions
References
https://www.npmjs.com/advisories/1417
https://www.npmjs.com/package/lodahs
https://www.npmjs.com/advisories/1417
https://www.npmjs.com/package/lodahs