Malicious Package in eslint-config-eslint
Version 5.0.2 of eslint-config-eslint was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to a remote server.
Recommendation
The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Users may consider downgrading to version 5.0.1
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | eslint-config-eslint | = 5.0.2 | no fix |
References
- Weakness (CWE)
-- Platform
- npm
- Package
eslint-config-eslint- Disclosed
- 01.09.2020
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-pv55-r6j3-wp94 - CC BY 4.0
Vulnerability history: eslint-config-eslint
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 07.2018 09.2020
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
Disclosures per year
- 2018: 1
- 2019: 0
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Malicious Package in eslint-config-eslint this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.