Vulnerability in eslint-plugin-prebid 0.0.1 - Malicious Code Detected

[d0gukank]

Description

npm audit dependency analysis tool has identified a vulnerability in the eslint-plugin-prebid package version 0.0.1 and other packages. The analysis indicates that eslint-plugin-prebid package contains malicious code which could potentially compromise the project at

Prebid.js/plugins/eslint/package.json

Line 2 in be66a45

"name": "eslint-plugin-prebid",

Link to More Information: socket.dev/npm/package/eslint-plugin-prebid/overview/0.0.1-security

Also I have shared the report of npm audit.

[patmmccann]

We believe someone else published "eslint-plugin-prebid". We don't depend on it.

Prebid.js/package.json

Line 62 in 546595f

"eslint-plugin-prebid": "file:./plugins/eslint",

points to local. We'll consider publishing an empty file. Previously flagged in #8971

[patmmccann]

https://socket.dev/npm/package/eslint-plugin-prebid/maintainers/3.0.0 this is not someone associated with the project.

[patmmccann]

Upgrading eslint will solve the issue wuith the plugin pointing to a local file, which seems to invite bad actors to publish