Malicious code in ably-cli (npm)
Summary
MAL-2024-1716: Malicious code in ably-cli (npm). Affects ably-cli versions 1.0.1 – 9.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ably-cli package is an npm package used for interacting with the Ably messaging platform. It provides a command-line interface (CLI) for managing Ably resources and performing various operations. The package allows developers to easily integrate Ably functionality into their applications and automate tasks related to Ably messaging. However, the ably-cli package has been found to contain malicious code, posing a security risk to users who install and use it.
Vulnerability Detail
The ably-cli package (versions 9.9.9, 1.1.0, 6.1.0, and 30.1.9) has been identified as containing malicious code. The origin of this malicious code is attributed to a security research firm, ReversingLabs. The specific details of the vulnerability have not been provided, but it is crucial to note that the presence of malicious code in the package can lead to various security risks. These risks may include unauthorized access to sensitive information, execution of arbitrary code, or compromise of the host system. Users who have installed any of the affected versions of ably-cli are advised to take immediate action to mitigate the potential impact of this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ably-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to follow the steps mentioned in the 'how_to_fix' section to address the issue.
Conclusion
The ably-cli package (versions 9.9.9, 1.1.0, 6.1.0, and 30.1.9) has been found to contain malicious code. Users who have installed any of these versions are at risk of various security issues. It is crucial to update to a secure version, remove the affected versions, and regularly update system dependencies to mitigate the impact of this vulnerability.
See every vulnerability recorded for ably-cli →
FAQ
ably-cli is an npm package that provides a command-line interface for managing Ably resources and integrating Ably functionality into applications.
The presence of malicious code in ably-cli can lead to unauthorized access to sensitive information, execution of arbitrary code, or compromise of the host system.
Versions 9.9.9, 1.1.0, 6.1.0, and 30.1.9 of ably-cli are affected by this vulnerability.
To fix the vulnerability, update ably-cli to a secure version, remove any affected versions, and reinstall the updated version. Regularly updating your system and dependencies is also recommended.
You can check the official npm registry or the GitHub repository of ably-cli for the latest secure version.
