CVE-2017-16061

CVE-2017-16061 describes a malicious npm module named "tkinter" designed to hijack environment variables. This vulnerability, affecting the tkinter_package, carries a high CVSS score of 7.5 due to its network-based attack vector and low attack complexity, potentially leading to high confidentiality impact. While the module has been unpublished and there are no known active exploits, public exploit code, or significant community discussion, its nature as a malicious package highlights the risk of supply chain attacks.