Malicious Code in airslate-static (npm)
Summary
MAL-2023-8450: Malicious code in airslate-static (npm). Affects airslate-static versions 9.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The airslate-static package is an npm package used for a specific purpose. It is designed to provide functionality related to [insert functionality]. This package is vulnerable to a malicious code injection attack, which compromises the security of any computer that has the package installed or running.
Vulnerability Detail
The vulnerability, identified as MAL-2023-8450, originates from the ghsa-malware source. It involves the presence of malicious code within the airslate-static package. This code grants full control of the affected computer to an external entity, compromising all secrets and keys stored on that machine. Immediate action is required to rotate all affected secrets and keys from a different computer. Although removing the package is recommended, it may not guarantee the complete removal of all malicious software resulting from its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall airslate-staticIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is crucial to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
Conclusion
The airslate-static package is vulnerable to a malicious code injection attack, compromising the security of any computer with the package installed or running. It is crucial to take immediate action by rotating all affected secrets and keys from a different, secure machine and removing the package. Conducting a thorough security audit is recommended to ensure no other malicious software remains on the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for airslate-static →
FAQ
The impact of this vulnerability is severe. Any computer with the airslate-static package installed or running is fully compromised, granting control to an external entity. All secrets and keys stored on the affected machine should be rotated immediately.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It does not require any signup and uses the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities.
Removing the airslate-static package is recommended, but it may not guarantee the complete removal of all malicious software resulting from its installation. A thorough security audit should be conducted to ensure no other malicious software remains on the system.
If your computer is affected, you should immediately rotate all secrets and keys stored on that machine from a different, secure computer. Follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
There is no specific workaround available for this vulnerability. It is crucial to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
