Is crossenv (+ ~37 typosquat packages) affected by CVE-2017-16074?

npm crossenv (+ ~37 typosquat packages) is affected in the listed versions.

Is CVE-2017-16074 being exploited?

Yes — it is on the CISA Known Exploited Vulnerabilities (KEV) list.

HIGHSupply chainexploited in the wildcurated

CVE-2017-16074

npm · crossenv (+ ~37 typosquat packages)

Résumé

In late July/August 2017, a user named 'hacktask' published around 37 typosquatting packages on npm with names mimicking popular libraries, the most notable being 'crossenv' (impersonating cross-env). The package replicated the legitimate functionality but added an install-time snippet that harvested all environment variables, often containing tokens, keys and credentials, and exfiltrated them to npm.hacktask.net. crossenv was tracked as CVE-2017-16074; actual installs were limited (estimated under ~50) and npm removed roughly 40 packages.

Références

https://nvd.nist.gov/vuln/detail/CVE-2017-16074
https://blog.npmjs.org/post/163723642530/crossenv-malware-on-the-npm-registry
https://www.bleepingcomputer.com/news/security/javascript-packages-caught-stealing-environment-variables/

Vulnérabilités liées

Tout Supply chain →

MEDIUMGHSA-8wvg-r2j4-3737
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
MEDIUMGHSA-3hc7-r24j-rpwc
Vikunja: Cross-project task disclosure through subtask expansion
MEDIUMCVE-2026-107842
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
MEDIUMCVE-2026-91981
Vikunja: Link-share token can enumerate users through the v2 API
MEDIUMCVE-2026-91980
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
HIGHCVE-2026-91985
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level