CWE-506
Allowed-with-ReviewEmbedded Malicious Code
Abstraction: Class · Status: Incomplete
The product contains code that appears to be malicious in nature.
553 vulnerabilities reference this CWE, most recent first.
GHSA-G9WF-393Q-4W38
Vulnerability from github – Published: 2020-09-03 17:28 – Updated: 2021-09-30 17:44All versions of only-test-not-install contain malicious code. The package deletes the folder ~/test from the system as a postinstall script.
Recommendation
Remove the package from your environment. There are no further signs of compromise.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "only-test-not-install"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:45:15Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `only-test-not-install` contain malicious code. The package deletes the folder `~/test` from the system as a postinstall script.\n\n\n## Recommendation\n\nRemove the package from your environment. There are no further signs of compromise.",
"id": "GHSA-g9wf-393q-4w38",
"modified": "2021-09-30T17:44:24Z",
"published": "2020-09-03T17:28:26Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1044"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in only-test-not-install"
}
GHSA-GCFC-MGG3-8J2C
Vulnerability from github – Published: 2020-09-03 18:11 – Updated: 2021-09-30 20:03All versions of sdfjghlkfjdshlkjdhsfg contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version.
Recommendation
Remove the package from your environment and ensure all packages owned were not impacted.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sdfjghlkfjdshlkjdhsfg"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:46:18Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `sdfjghlkfjdshlkjdhsfg` contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version.\n\n\n## Recommendation\n\nRemove the package from your environment and ensure all packages owned were not impacted.",
"id": "GHSA-gcfc-mgg3-8j2c",
"modified": "2021-09-30T20:03:20Z",
"published": "2020-09-03T18:11:29Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1072"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in sdfjghlkfjdshlkjdhsfg"
}
GHSA-GF5Q-Q6H6-J87V
Vulnerability from github – Published: 2026-08-05 12:31 – Updated: 2026-08-05 12:31Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.
{
"affected": [],
"aliases": [
"CVE-2026-66747"
],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-05T11:16:25Z",
"severity": "CRITICAL"
},
"details": "Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel\u0027s [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.",
"id": "GHSA-gf5q-q6h6-j87v",
"modified": "2026-08-05T12:31:30Z",
"published": "2026-08-05T12:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66747"
},
{
"type": "WEB",
"url": "https://github.com/ycsunjane/rctl"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/zbt-endlessdoors"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/blog/zbt-endlessdoors"
},
{
"type": "WEB",
"url": "https://www.zbtlink.com/pages/zbt-router-firmware-download"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GFJ6-P24G-6HPM
Vulnerability from github – Published: 2020-09-03 22:55 – Updated: 2021-09-30 16:35Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.
Recommendation
Remove the package from your environment. Ensure no Ethereum funds were compromised.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jc-sha3"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:53:28Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.\n\n\n## Recommendation\n\nRemove the package from your environment. Ensure no Ethereum funds were compromised.",
"id": "GHSA-gfj6-p24g-6hpm",
"modified": "2021-09-30T16:35:07Z",
"published": "2020-09-03T22:55:06Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1277"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in jc-sha3"
}
GHSA-GFJR-XQHM-QVV3
Vulnerability from github – Published: 2020-09-02 20:16 – Updated: 2021-10-01 14:01All versions of aysnc typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.
Recommendation
Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "aysnc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:38:02Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `aysnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.\n\n\n## Recommendation\n\nRemove the package from your dependencies and always ensure package names are typed correctly upon installation.",
"id": "GHSA-gfjr-xqhm-qvv3",
"modified": "2021-10-01T14:01:11Z",
"published": "2020-09-02T20:16:09Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/848"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in aysnc"
}
GHSA-GFM8-G3VM-53JH
Vulnerability from github – Published: 2020-09-03 17:21 – Updated: 2021-09-30 17:16Versions 0.1.2 and 0.1.3 of leetlog contain malicious code. The package adds an arbitrary hardcoded SSH key identified as hacker@evilmachine to the system's authorized_keys
Recommendation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "leetlog"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:45:08Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Versions 0.1.2 and 0.1.3 of `leetlog` contain malicious code. The package adds an arbitrary hardcoded SSH key identified as `hacker@evilmachine` to the system\u0027s `authorized_keys`\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-gfm8-g3vm-53jh",
"modified": "2021-09-30T17:16:55Z",
"published": "2020-09-03T17:21:19Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1041"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in leetlog"
}
GHSA-GFV4-2VHM-486M
Vulnerability from github – Published: 2018-07-23 20:50 – Updated: 2023-09-07 18:21The node-fabric package is a piece of malware that steals environment variables and sends them to attacker controlled locations.
All versions have been unpublished from the npm registry.
Recommendation
As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there.
If you have found this installed in your environment, you should: 1. Delete the package 2. Clear your npm cache 3. Ensure it is not present in any other package.json files on your system 4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables.
Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "node-fabric"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-16052"
],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:37:09Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "The `node-fabric` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. \n\nAll versions have been unpublished from the npm registry.\n\n\n## Recommendation\n\nAs this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. \n\nIf you have found this installed in your environment, you should:\n1. Delete the package\n2. Clear your npm cache\n3. Ensure it is not present in any other package.json files on your system\n4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. \n\nAdditionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.",
"id": "GHSA-gfv4-2vhm-486m",
"modified": "2023-09-07T18:21:29Z",
"published": "2018-07-23T20:50:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16052"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-gfv4-2vhm-486m"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/489"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "node-fabric is malware"
}
GHSA-GMJP-776J-2394
Vulnerability from github – Published: 2020-09-03 17:04 – Updated: 2021-10-01 21:04All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.
Recommendation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "ripmed160"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:58:08Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-gmjp-776j-2394",
"modified": "2021-10-01T21:04:56Z",
"published": "2020-09-03T17:04:24Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1405"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in ripmed160"
}
GHSA-GPG2-7R7J-4PM9
Vulnerability from github – Published: 2020-09-03 22:09 – Updated: 2021-09-29 21:05Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.
Recommendation
Remove the package from your environment. Ensure no Ethereum funds were compromised.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "buffer-xob"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:52:20Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.\n\n\n## Recommendation\n\nRemove the package from your environment. Ensure no Ethereum funds were compromised.",
"id": "GHSA-gpg2-7r7j-4pm9",
"modified": "2021-09-29T21:05:05Z",
"published": "2020-09-03T22:09:56Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1249"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in buffer-xob"
}
GHSA-GQQ4-937C-2282
Vulnerability from github – Published: 2020-09-03 22:49 – Updated: 2021-09-30 16:18Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.
Recommendation
Remove the package from your environment. Ensure no Ethereum funds were compromised.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "juffer-xor"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:53:17Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.\n\n\n## Recommendation\n\nRemove the package from your environment. Ensure no Ethereum funds were compromised.",
"id": "GHSA-gqq4-937c-2282",
"modified": "2021-09-30T16:18:15Z",
"published": "2020-09-03T22:49:42Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1272"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in juffer-xor"
}
Mitigation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
CAPEC-442: Infected Software
An adversary adds malicious logic, often in the form of a computer virus, to otherwise benign software. This logic is often hidden from the user of the software and works behind the scenes to achieve negative impacts. Many times, the malicious logic is inserted into empty space between legitimate code, and is then called when the software is executed. This pattern of attack focuses on software already fielded and used in operation as opposed to software that is still under development and part of the supply chain.
CAPEC-448: Embed Virus into DLL
An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.
CAPEC-636: Hiding Malicious Data or Code within Files
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.