CVE-2017-16127: Infecting Module in pandora-doomsday
Summary
CVE-2017-16127: pandora-doomsday is malware. Affects pandora-doomsday versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pandora-doomsday package is a module that is designed to add itself to the package.json file of other packages found on the victim host. Once installed, it attempts to publish the package. This package has been identified as malicious and has been removed from the npm registry.
Vulnerability Detail
The pandora-doomsday package poses a significant security risk as it can compromise the entire system it is installed on. Any computer with this package installed or running should be considered fully compromised. This means that all secrets and keys stored on that computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The pandora-doomsday package has been identified as a malicious package that can compromise the entire system it is installed on. It is crucial to take immediate action by identifying affected systems, rotating secrets and keys, and removing the package. Conducting a thorough security audit is also recommended to ensure the system is clean. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pandora-doomsday →
FAQ
The impact of this vulnerability is severe as it can compromise the entire system it is installed on. All secrets and keys stored on the affected system should be rotated immediately.
You can check if your system is affected by using the Vulert Playground at Vulert Scanner. Simply enter your package-lock.json file and it will alert you if your application is affected.
No, removing the pandora-doomsday package does not guarantee the removal of all malicious software resulting from its installation. A thorough security audit should be conducted to ensure the system is clean.
If your system is compromised, it is recommended to rotate all secrets and keys stored on that system from a different computer. Additionally, conduct a thorough security audit to identify and remove any other malicious software.
No, there is no known workaround for this vulnerability. It is crucial to follow the recommended steps to fix the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for pandora-doomsday.
