Malicious Package in angluar-cli: GHSA-8mm3-2mcj-cx6r
Summary
GHSA-8mm3-2mcj-cx6r: Malicious Package in angluar-cli. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
angluar-cli is an open-source package in the npm ecosystem. It is a command-line interface tool used for developing Angular applications. angluar-cli provides various features and functionalities to streamline the development process. However, version 0.0.3 of angluar-cli has been found to contain a malicious code as a postinstall script.
Vulnerability Detail
The malicious package in angluar-cli, identified as GHSA-8mm3-2mcj-cx6r, is designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package attempts to remove files and stop processes related to McAfee antivirus on macOS. This vulnerability poses a critical risk to affected systems, potentially leading to the deletion of important files and the disruption of antivirus protection.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, angluar-cli version 0.0.3 contains a malicious package (GHSA-8mm3-2mcj-cx6r) that can delete files and disrupt McAfee antivirus processes on macOS. It is crucial to remove the package, verify file integrity, and consider updating to a secure version or using alternative packages. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for angluar-cli →
FAQ
angluar-cli is a command-line interface tool used for developing Angular applications. It provides various features and functionalities to streamline the development process.
This vulnerability can lead to the deletion of files and the disruption of McAfee antivirus processes on macOS systems.
To fix this vulnerability, remove the angluar-cli package, verify file integrity, and consider updating to a secure version or using alternative packages.
The advisory specifically mentions version 0.0.3 of angluar-cli. However, it is recommended to exercise caution and verify the security of other versions as well.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-8mm3-2mcj-cx6r/GHSA-8mm3-2mcj-cx6r.json
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
