{"action":"Upgrade npm to 2.15.1 or later.","affected":[{"fixed":"2.15.1","introduced":"0"},{"fixed":"3.8.3","introduced":"3.0.0"}],"component":"npm","cve_ids":["CVE-2016-3956"],"ecosystem":"npm","epss":0.05456,"exploited":false,"fixed_versions":["2.15.1","3.8.3"],"ghsa_id":"GHSA-m5h6-hr3q-22h5","id":"tcs_01M5KFZMP1A12XE1M10K58FBZ8","modified_at":"2026-09-10T03:47:01.644240263Z","published_at":"2018-07-31T22:58:35Z","references":["https://osv.dev/vulnerability/GHSA-m5h6-hr3q-22h5","https://nvd.nist.gov/vuln/detail/CVE-2016-3956","https://github.com/npm/npm/issues/8380","https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29","https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401","https://github.com/advisories/GHSA-m5h6-hr3q-22h5","https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016","https://www.npmjs.com/advisories/98","http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability","http://www-01.ibm.com/support/docview.wss?uid=swg21980827"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-m5h6-hr3q-22h5","url":"https://osv.dev/vulnerability/GHSA-m5h6-hr3q-22h5"},{"source":"nvd","source_id":"CVE-2016-3956","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3956"}],"summary":"npm Token Leak in npm"}