Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
npm Package bcrypt Malware Exposes Sensitive Data
published 2 years ago
Summary
A malicious version of the bcrypt package, used for password hashing, was found to exfiltrate sensitive data to a remote server. This means that if you have installed this malicious package in your project, attackers may have gained access to your sensitive information. We recommend checking your dependencies and updating the bcrypt package to a trusted version.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | cipherbcrypt | All versions |
Original advisory text
Malware package cipherbcrypt
Malicious package. Exfiltrated secrets to a target server.
Timeline
Published12 Jul 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-5grr-72f9-678v · GHSA
Track software like this
Free during beta