Critical Vulnerability in appx-compiler
Summary
GHSA-8q2c-2396-hf7j: Malicious Package in appx-compiler. Affects appx-compiler versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The appx-compiler package is an npm package used for compiling appx packages. It is commonly used in Windows development environments to package and distribute Windows applications. The package is vulnerable to a critical security issue that allows an attacker to upload system information to a remote server, download and execute malicious files. This vulnerability affects all versions of the appx-compiler package.
Vulnerability Detail
The appx-compiler package contains malicious code that compromises the security of the system. When installed or running on a computer, the package uploads system information to a remote server and downloads a file, which is then executed. This gives full control of the computer to an outside entity, compromising all secrets and keys stored on that computer. Removing the package does not guarantee the removal of all malicious software resulting from its installation. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The appx-compiler package contains a critical vulnerability that compromises the security of the system. Immediate action is required to rotate all secrets and keys stored on affected computers. Removing the package may not remove all malicious software, and additional steps may be necessary. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for appx-compiler →
FAQ
The appx-compiler package is an npm package used for compiling appx packages in Windows development environments.
The vulnerability allows an attacker to upload system information to a remote server, download and execute malicious files, compromising the security of the system.
Yes, all versions of the appx-compiler package are affected by this vulnerability.
If you have the appx-compiler package installed, consider your computer fully compromised. Rotate all secrets and keys stored on that computer immediately from a different computer.
Removing the appx-compiler package does not guarantee the removal of all malicious software installed as a result of its presence. Additional steps may be required to ensure the system's security.
References
Related vulnerabilities
Recent vulnerabilities recorded for appx-compiler.
