Malicious code in @zscaler/api-enums (npm)
Summary
MAL-2023-8487: Malicious code in @zscaler/api-enums (npm). Affects @zscaler/api-enums versions 5.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @zscaler/api-enums package is an npm package that provides a set of enums for Zscaler API. It is used to interact with the Zscaler platform and perform various operations. The package is widely used by developers to integrate Zscaler functionality into their applications.
Vulnerability Detail
The @zscaler/api-enums package version 5.0.0 has been identified as malicious. The package communicates with a domain associated with malicious activity and executes commands that are linked to malicious behavior. This vulnerability poses a significant risk to applications that depend on this package, as it can potentially lead to unauthorized access, data breaches, or other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @zscaler/api-enumsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the malicious package and replace it with a safe version as soon as possible.
Conclusion
The @zscaler/api-enums package version 5.0.0 has been identified as malicious and poses a significant risk to applications. It is crucial to remove this package and replace it with a safe version to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @zscaler/api-enums →
FAQ
The @zscaler/api-enums package is an npm package that provides a set of enums for Zscaler API. It is used to interact with the Zscaler platform and perform various operations.
This vulnerability can lead to unauthorized access, data breaches, or other malicious activities in applications that depend on the @zscaler/api-enums package version 5.0.0.
To fix this vulnerability, remove the @zscaler/api-enums package version 5.0.0 from your application and update to a safe version that has been patched to address this issue.
No, there is no known workaround for this vulnerability. It is crucial to remove the malicious package and replace it with a safe version.
For more information about this vulnerability and its impact, you can visit the Vulert Playground at Vulert Scanner
