Malicious Package in 8.9.4 - Open Source Vulnerability
Summary
GHSA-725f-3pw7-rq6x: Malicious Package in 8.9.4. Affects 8.9.4 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package '8.9.4' is an npm package that is vulnerable to a malicious code injection. It is commonly used in software development projects and provides various functionalities. However, versions 1.0.2, 1.0.3, 1.0.4, and 1.0.5 of the package contain a preinstall script that executes malicious code. This code reads the system's SSH keys but does not upload them to a remote server. The package has been identified as a security risk and should be removed from the environment.
Vulnerability Detail
The vulnerability in '8.9.4' arises from the inclusion of a malicious preinstall script in versions 1.0.2 to 1.0.5. This script is designed to extract the system's SSH keys, potentially compromising the security of the system. Although there is no evidence of the extracted keys being uploaded to a remote server, the presence of this code poses a significant risk. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. It is important to take immediate action to mitigate the potential impact.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to remove the '8.9.4' package from the environment and follow the recommended steps to fix the issue.
Conclusion
In conclusion, the '8.9.4' package contains a malicious preinstall script in versions 1.0.2 to 1.0.5, which can extract the system's SSH keys. Although there is no evidence of the keys being uploaded to a remote server, the presence of this code poses a significant security risk. It is recommended to remove the package from the environment and take necessary steps to ensure the security of SSH keys. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for 8.9.4 →
FAQ
The vulnerability allows the malicious code to read the system's SSH keys, potentially compromising the security of the system. However, there is no evidence of the extracted keys being uploaded to a remote server.
Versions 1.0.2, 1.0.3, 1.0.4, and 1.0.5 of '8.9.4' are affected by this vulnerability.
At the moment, there is no evidence of further compromise beyond the extraction of SSH keys. However, it is crucial to take immediate action to mitigate the risk.
You can remove the '8.9.4' package by using the package manager's uninstall command or by manually removing it from the project dependencies.
After removing the '8.9.4' package, it is advisable to review the system's SSH keys and take appropriate measures to ensure their security. This may include generating new keys, updating access controls, and monitoring for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for 8.9.4.
