Malicious Package in aasync
Summary
GHSA-9mjp-gv34-3jcf: Malicious Package in aasync. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aasync package is an npm package that provides asynchronous control flow utilities for JavaScript. It allows developers to handle asynchronous operations in a more organized and efficient manner. However, all versions of aasync were found to contain a malicious package that impersonated a popular package with a similar name. This malicious package tracked users who installed it and collected information such as the downloaded package's name, the intended package's name, the Node version, and whether the process was running with sudo privileges. The package did not compromise any further. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
Vulnerability Detail
The vulnerability in aasync arises from the inclusion of a malicious package that typosquatted a popular package. When users mistakenly installed the malicious package, it collected sensitive information and sent it to a remote server. The collected data included the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running with sudo privileges. This information could potentially be used for malicious purposes, such as targeted attacks or identity theft. It is crucial to remove the package from dependencies and ensure that package names are typed correctly during installation to mitigate this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The aasync package contained a malicious package that typosquatted a popular package, tracking users who installed it and collecting sensitive information. To mitigate this vulnerability, it is crucial to remove the package from dependencies and ensure correct package names during installation. Additionally, using package-lock.json or a similar mechanism can help prevent typosquatting attacks in the future. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for aasync →
FAQ
aasync is an npm package that provides asynchronous control flow utilities for JavaScript. It helps developers manage asynchronous operations in a more organized and efficient manner.
The malicious package in aasync tracks users by collecting information such as the name of the downloaded package, the name of the intended package, the Node version, and whether the process is running with sudo privileges. This information is then sent to a remote server for further analysis.
Installing the malicious package can lead to potential risks such as targeted attacks, identity theft, or unauthorized access to sensitive information. The collected data can be used by malicious actors for various malicious purposes.
To mitigate the vulnerability, remove the aasync package from your project's dependencies and ensure that package names are typed correctly during installation. It is also recommended to use package-lock.json or a similar mechanism to ensure package integrity and prevent typosquatting attacks.
Yes, the fix for the vulnerability is to remove the aasync package from your project's dependencies and ensure that the correct package is installed by checking the package name and version.
References
Related vulnerabilities
Recent vulnerabilities recorded for aasync.
