CVE-2022-659: Malicious code in @tinkoff-react-bui/input-password (npm)
Summary
MAL-2022-659: Malicious code in @tinkoff-react-bui/input-password (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @tinkoff-react-bui/input-password package is an npm package that provides functionality for handling password inputs in React applications. It is commonly used to create secure input fields for password entry. However, the package has been found to contain malicious code, which poses a significant security risk to any computer that has this package installed or running.
Vulnerability Detail
The malicious code in @tinkoff-react-bui/input-password has been identified as a serious security threat. Any computer with this package installed should be considered fully compromised. The code may have given outside entities full control over the computer, potentially exposing all secrets and keys stored on it. Immediate action is required to rotate all affected secrets and keys from a different computer. While removing the package is recommended, it may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @tinkoff-react-bui/input-passwordIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The @tinkoff-react-bui/input-password package has been found to contain malicious code, posing a significant security risk. It is crucial to take immediate action to rotate affected secrets and keys, remove the package, and conduct a thorough security scan. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for @tinkoff-react-bui/input-password →
FAQ
The impact of this vulnerability is severe. Any computer with the @tinkoff-react-bui/input-password package installed is fully compromised, potentially exposing all stored secrets and keys.
To protect your computer, immediately rotate all affected secrets and keys from a different, secure computer. Remove the @tinkoff-react-bui/input-password package and conduct a thorough security scan.
While removing the package is recommended, it may not guarantee the removal of all malicious software resulting from its installation. A thorough security scan is necessary to ensure complete mitigation.
Yes, consider using alternative, trusted packages for handling password inputs in your React application. Ensure that the chosen package has a good reputation and is regularly maintained.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your package-lock.json file for analysis without the need for signup or code access.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
