CVE-2017-16127
highpriority · track · 40OT risk · elevatedEPSS 0.014 · 73 %ileEUUSEPSS · scored 2026-10-27
The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9–10
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- pandora-doomsday project pandora-doomsday= 0.0.1nvdUScpe:2.3:a:pandora-doomsday_project:pandora-doomsday:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-428f-mh7w-6w2xpandora-doomsday is malware2020-09-01ghsa · osvUS
The `pandora-doomsday` package is a malicious package that adds itself to the package.json of other packages discovered on the victim host and attempts to publish the package. It has been removed from the npm registry. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan