Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

eslint-config-airbnb-standard

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8npmAmendedPublished

    Malicious Package in eslint-config-airbnb-standard

    GHSA-m852-866j-69j8

    Affected
    • npm eslint-config-airbnb-standard >= 2.0.0, <= 2.0.0
    Fixed in
    2.1.0· Vendor fix available
    Issue
    Version 2.0.0 of eslint-config-airbnb-standard was published with a bundled version of eslint-scope that was found to contain malicious code. This code would read the users .npmrc file and send it's contents to a remote server. Recommendation The best course of action if you found this package installed in your environment is to revoke all your npm tokens and use a different version of the module. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/workingwithtokens#how-to-revoke-tokens

    Recommended action: Upgrade to 2.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →