{"vulnerability": "cve-2021-43616", "sightings": [{"uuid": "b66d4608-a9c4-4719-8a49-f67772df095a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/861", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aRepo demonstrating CVE-2021-43616 / https://github.com/npm/cli/issues/2701\nURL\uff1ahttps://github.com/icatalina/CVE-2021-43616", "creation_timestamp": "2021-11-15T01:10:50.000000Z"}, {"uuid": "a424275d-6f39-4214-bb7a-7356f94f8695", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "seen", "source": "https://t.me/cibsecurity/32376", "content": "\u203c CVE-2021-43616 \u203c\n\nThe npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-13T20:40:17.000000Z"}, {"uuid": "fee4acad-a1e7-4819-a0ac-0a5f4a2b0341", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1185", "content": "#exploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616\n\n@BlueRedTeam", "creation_timestamp": "2021-11-16T09:37:44.000000Z"}, {"uuid": "fc0d23bd-8ac9-44b5-b3ec-3fa0fb5f3a85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4765", "content": "#exploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616", "creation_timestamp": "2021-11-16T11:01:01.000000Z"}, {"uuid": "1f981014-bf71-4f3d-a134-8565fcb2e86a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "seen", "source": "https://t.me/cissp/4832", "content": "Fuzzing Microsoft's RDP Client using Virtual Channels: Overview & Methodology\nhttps://thalium.github.io/blog/posts/fuzzing-microsoft-rdp-client-using-virtual-channels\n\nThreat Research\n1. Android WebView and Its Vulnerabilities\nhttps://blog.securelayer7.net/learn-about-android-webview-and-its-vulnerabilities\n2. Groups Target Alibaba ECS Instances for Cryptojacking\nhttps://www.trendmicro.com/en_us/research/21/k/groups-target-alibaba-ecs-instances-for-cryptojacking.html\n\nexploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616\n\nMalware analysis\n1. Uncovering MosesStaff techniques:\nIdeology over Money\nhttps://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies\n2. Malware uses namesilo Parking pages and Google's custom pages to spread\nhttps://blog.netlab.360.com/zhatuniubility-malware-uses-namesilo-parking-pages-and-googles-custom-pages-to-spread\n3. Exchange Exploit Leads to Domain Wide Ransomware\ud83d\ude01\nhttps://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware", "creation_timestamp": "2026-09-01T17:00:35.355684Z"}, {"uuid": "2ca4393b-d308-4a40-a2c1-92a9557f52e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "seen", "source": "https://t.me/cissp/4832", "content": "Fuzzing Microsoft's RDP Client using Virtual Channels: Overview & Methodology\nhttps://thalium.github.io/blog/posts/fuzzing-microsoft-rdp-client-using-virtual-channels\n\nThreat Research\n1. Android WebView and Its Vulnerabilities\nhttps://blog.securelayer7.net/learn-about-android-webview-and-its-vulnerabilities\n2. Groups Target Alibaba ECS Instances for Cryptojacking\nhttps://www.trendmicro.com/en_us/research/21/k/groups-target-alibaba-ecs-instances-for-cryptojacking.html\n\nexploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616\n\nMalware analysis\n1. Uncovering MosesStaff techniques:\nIdeology over Money\nhttps://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies\n2. Malware uses namesilo Parking pages and Google's custom pages to spread\nhttps://blog.netlab.360.com/zhatuniubility-malware-uses-namesilo-parking-pages-and-googles-custom-pages-to-spread\n3. Exchange Exploit Leads to Domain Wide Ransomware\ud83d\ude01\nhttps://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware", "creation_timestamp": "2026-09-02T01:04:19.986988Z"}, {"uuid": "1141faa7-5b61-4e16-8f45-ece7acbc8806", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4832", "content": "Fuzzing Microsoft's RDP Client using Virtual Channels: Overview & Methodology\nhttps://thalium.github.io/blog/posts/fuzzing-microsoft-rdp-client-using-virtual-channels\n\nThreat Research\n1. Android WebView and Its Vulnerabilities\nhttps://blog.securelayer7.net/learn-about-android-webview-and-its-vulnerabilities\n2. Groups Target Alibaba ECS Instances for Cryptojacking\nhttps://www.trendmicro.com/en_us/research/21/k/groups-target-alibaba-ecs-instances-for-cryptojacking.html\n\nexploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616\n\nMalware analysis\n1. Uncovering MosesStaff techniques:\nIdeology over Money\nhttps://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies\n2. Malware uses namesilo Parking pages and Google's custom pages to spread\nhttps://blog.netlab.360.com/zhatuniubility-malware-uses-namesilo-parking-pages-and-googles-custom-pages-to-spread\n3. Exchange Exploit Leads to Domain Wide Ransomware\ud83d\ude01\nhttps://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware", "creation_timestamp": "2026-09-10T15:00:07.595361Z"}, {"uuid": "32aac2b4-39fd-4995-a5fc-96b9c045687a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4832", "content": "Fuzzing Microsoft's RDP Client using Virtual Channels: Overview & Methodology\nhttps://thalium.github.io/blog/posts/fuzzing-microsoft-rdp-client-using-virtual-channels\n\nThreat Research\n1. Android WebView and Its Vulnerabilities\nhttps://blog.securelayer7.net/learn-about-android-webview-and-its-vulnerabilities\n2. Groups Target Alibaba ECS Instances for Cryptojacking\nhttps://www.trendmicro.com/en_us/research/21/k/groups-target-alibaba-ecs-instances-for-cryptojacking.html\n\nexploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616\n\nMalware analysis\n1. Uncovering MosesStaff techniques:\nIdeology over Money\nhttps://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies\n2. Malware uses namesilo Parking pages and Google's custom pages to spread\nhttps://blog.netlab.360.com/zhatuniubility-malware-uses-namesilo-parking-pages-and-googles-custom-pages-to-spread\n3. Exchange Exploit Leads to Domain Wide Ransomware\ud83d\ude01\nhttps://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware", "creation_timestamp": "2026-09-11T00:00:35.964674Z"}, {"uuid": "213eac39-35ba-4470-8eee-173849378ac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "seen", "source": "Telegram/ihh6lu2JwVHbxCCtzMwz7J2so3OYSU8lmtMIGGUfSqoltoc", "content": "", "creation_timestamp": "2026-09-18T04:00:13.549409Z"}, {"uuid": "fba27bff-3018-42c7-84ca-17984a800014", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "Telegram/ihh6lu2JwVHbxCCtzMwz7J2so3OYSU8lmtMIGGUfSqoltoc", "content": "", "creation_timestamp": "2026-09-19T00:00:13.194618Z"}]}