Malicious Package in alipayjsapi
Summary
GHSA-rjhc-w3fj-j6x9: Malicious Package in alipayjsapi. Affects alipayjsapi versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The alipayjsapi package is an npm package used for integrating Alipay payment functionality into web applications. It provides a set of APIs and tools for developers to interact with Alipay's payment system. However, all versions of alipayjsapi contain a malicious code that uploads system information to a remote server, downloads and executes a file. This vulnerability poses a critical security risk to any computer that has this package installed or running.
Vulnerability Detail
The alipayjsapi package contains a malicious code that compromises the security of the system it is installed on. The package uploads system information to a remote server, allowing an outside entity to gain full control of the compromised computer. This can lead to unauthorized access, data theft, and potential harm to the system. It is crucial to consider any computer with this package installed as fully compromised, and all secrets and keys stored on that computer should be rotated immediately from a different computer.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The alipayjsapi package contains a critical vulnerability that compromises the security of the system it is installed on. Any computer with this package installed or running should be considered fully compromised, and immediate action should be taken to remove the package and perform a thorough security audit. It is essential to rotate all secrets and keys stored on the compromised computer from a different, trusted computer. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for alipayjsapi →
FAQ
The impact of this vulnerability is severe. Any computer with the alipayjsapi package installed or running should be considered fully compromised. The malicious code allows an outside entity to gain full control of the compromised computer, potentially leading to unauthorized access, data theft, and other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using package-lock.json to assess the presence of vulnerabilities without requiring access to the code or installation.
If your system is affected by this vulnerability, it is crucial to take immediate action. Remove the alipayjsapi package from the affected system and perform a thorough security audit to ensure the complete removal of any malicious components. Additionally, all secrets and keys stored on the compromised computer should be rotated immediately from a different, trusted computer.
No, the risk cannot be effectively mitigated without removing the alipayjsapi package. The package contains a malicious code that compromises the security of the system it is installed on. Removing the package is necessary to eliminate the vulnerability and prevent further exploitation.
No, there is no fix or update available for the alipayjsapi package. The package itself is compromised, and it is recommended to remove it from the affected system.
References
Related vulnerabilities
Recent vulnerabilities recorded for alipayjsapi.
