CVE-2017-16128: Malicious Package in npm-script-demo
Summary
CVE-2017-16128: npm-script-demo is malware. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm-script-demo package is a piece of malware that opens a connection to a command and control server and executes the instructions it is given. It has been removed from the npm registry.
Vulnerability Detail
The npm-script-demo package contains a malicious payload that compromises the security of any computer it is installed on. Once installed, it establishes a connection to a command and control server, allowing an external entity to gain full control over the compromised computer. This can lead to the exposure of sensitive information, such as secrets and keys stored on the affected machine. Although the package has been removed from the npm registry, the presence of the malware on a computer requires immediate action to mitigate the potential damage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The npm-script-demo package has been identified as a malicious package that compromises the security of the affected computer. It is crucial to take immediate action if this package is installed or running on any computer. Rotate all secrets and keys stored on the affected computer from a different, secure computer, and remove the package. However, it is important to note that further investigation and remediation may be necessary to ensure the complete elimination of any potential threats. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm-script-demo →
FAQ
The impact of this vulnerability is severe as it allows an external entity to gain full control over the compromised computer. This can lead to the exposure of sensitive information and potential misuse of the compromised system.
Yes, the npm-script-demo package has been removed from the npm registry.
If you have the npm-script-demo package installed, you should consider your computer as fully compromised. It is recommended to rotate all secrets and keys stored on the affected computer from a different, secure computer. Additionally, the package should be removed, but further investigation and remediation may be necessary to ensure complete elimination of any potential threats.
No, there is no guarantee that removing the npm-script-demo package will remove all malicious software resulting from its installation. A thorough investigation and remediation process should be conducted to ensure the complete elimination of any potential threats.
For further information about this vulnerability, you can visit the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-322m-p39j-r5m2/GHSA-322m-p39j-r5m2.json
References
Related vulnerabilities
Recent vulnerabilities recorded for npm-script-demo.
