VDB

GCVE-110-CERTCC-2016-319816

GCVE-110-CERTCC-2016-319816
Advisory PublishedCVSS 6.0/10
Vulnetix · Advisory published March 25, 2016
npm allows packages to take actions that could result in a malicious npm package author to create a worm that spreads across the majority of the npm ecosystem.
Download JSON Open in Console

Risk Scores

CVSS 2.0
6.0/10
Medium · AV:N/AC:M/Au:S/C:P/I:P/A:P
certcc-cam
certcc-cam
impact0population0exploitation0widely_known0score_current0ease_of_exploitation0
certcc-vrda
certcc-vrda
d1_impact4d1_population2d1_direct_report1
certcc-cvss-temporal-env
certcc-cvss-temporal-env
temporal_score5.1remediation_levelWreport_confidenceCenvironmental_score3.84489471202594target_distributionMenvironmental_vectorCDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

npm fails to restrict the actions of malicious npm packages
url
npm fails to restrict the actions of malicious npm packages
url
npm fails to restrict the actions of malicious npm packages
url
npm fails to restrict the actions of malicious npm packages
url
npm fails to restrict the actions of malicious npm packages
url
npm fails to restrict the actions of malicious npm packages
url
npm fails to restrict the actions of malicious npm packages
url
npm fails to restrict the actions of malicious npm packages
url
npm fails to restrict the actions of malicious npm packages
url
npm fails to restrict the actions of malicious npm packages
advisory

Browse GCVE Records

73,393 records in the GCVE database · Updated July 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›