CVE-2017-16047 — mysqljs
HIGHCVE-2017-16047 is a high-severity (CVSS 7.5) CWE-506 vulnerability in mysqljs. No vendor fix is recorded yet; mitigation options are listed below.
mysqljs is malware
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2017-16047 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, a proxy for how much of the ecosystem is exposed.
mysqljsnpmDescription
The mysqljs package is a piece of malware that steals environment variables and sends them to attacker controlled locations.
All versions have been unpublished from the npm registry.
Recommendation
As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there.
If you have found this installed in your environment, you should:
- Delete the package
- Clear your npm cache
- Ensure it is not present in any other package.json files on your system
- Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables.
Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | mysqljs | ≥ 0.0.0 | No fix |
Affected Products
mysqljsmysqljs_projectDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mysqljs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of mysqljs has shipped for CVE-2017-16047 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
Frequently Asked Questions
Is CVE-2017-16047 in your dependencies?
Find it across npm, including transitive dependencies.