Malicious Package in eslint-scope
Version 3.7.2 of eslint-scope was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to 2 remote servers.
Recommendation
The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | eslint-config-eslint | >= 5.0.2, < 6.0.0 | 6.0.0 |
| npm package | eslint-scope | >= 3.7.2, < 3.7.3 | 3.7.3 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-506- Platform
- npm
- Package
eslint-config-eslint, eslint-scope- Disclosed
- 12.07.2018
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-hxxf-q3w9-4xgw - CC BY 4.0
Vulnerability history: eslint-config-eslint
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 07.2018 09.2020
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
Disclosures per year
- 2018: 1
- 2019: 0
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Malicious Package in eslint-scope this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.