Falhas do tipo CWE-506

103 resultados

Código malicioso embutido

É quando código malicioso é intencionalmente inserido dentro de um componente legítimo de software, muitas vezes durante o desenvolvimento, build ou distribuição. O risco é que a aplicação executa lógica destrutiva ou de exfiltração de dados sem que o usuário final (ou até o proprietário) tenha consciência.

Exemplo

Um desenvolvedor comprometido adiciona uma função que envia credenciais de usuários para um servidor externo sempre que um formulário de login é submetido. O código fica dorminhoco na base de código e passa por code review se o revisor não estiver atento ou também estiver comprometido.

Como mitigar

Implemente verificação de integridade de código (assinatura digital de builds), auditoria rigorosa de mudanças via git history e acesso restrito ao repositório, testes de segurança automatizados que detectem chamadas suspeitas para servidores externos, e isolamento de ambientes de desenvolvimento e produção.

CVE-2017-16079—smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16204—The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.EPSS 1.1%CVE-2017-16059—mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16058—gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16203—The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installaEPSS 1.1%CVE-2017-16067—node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16050—`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16055—`sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16071—nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16066—opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16056—mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16045—`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16078—shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16057—nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2017-16062—node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.EPSS 1.1%CVE-2025-32965CRITICALCompromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2EPSS 0.9%CVE-2023-2003CRITICALEmbedded malicious code vulnerability in Unitronics Vision1210EPSS 0.9%CVE-2026-74232CRITICALZbtlink MQWrt yunmgrd Cloud C2 ImplantEPSS 0.8%CVE-2026-77650CRITICALThe append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it haEPSS 0.8%CVE-2026-77649CRITICALThe internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rEPSS 0.8%