CVE-2019-19771

HIGH

lodahs 0.0.1 - Cryptocurrency Wallet Data Exfiltration

Title source: llm
STIX 2.1

Description

The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.

References (2)

Core 2
Core References
Product x_refsource_misc
https://www.npmjs.com/package/lodahs
Third Party Advisory x_refsource_misc
https://www.npmjs.com/advisories/1417

Scores

CVSS v3 8.8
EPSS 0.0126
EPSS Percentile 66.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Status published
Products (2)
lodahs_project/lodahs 1.0.0
npm/lodahs 0.0.1npm
Published Dec 12, 2019
Tracked Since Feb 18, 2026