CVE-2019-19771
High
Description
The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.
SeverityHigh
CVSS8.8
Exploit probability—
ProductLodahs
PublishedDec 12, 2019
First seenDec 12, 2019
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lodahs_project lodahs | 1.0.0 | — |
| lodahsnpm | 0.0.1 ≤ v | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.