Malicious Package in asnyc
Summary
GHSA-v99v-xgjx-7m7g: Malicious Package in asnyc. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The asnyc package is an open-source package available on the npm ecosystem. It provides asynchronous control flow with a simple and intuitive API. It is widely used by developers to handle asynchronous operations in Node.js applications. However, all versions of asnyc were found to contain a malicious package that was typosquatted on a popular package of similar name. This malicious package tracked users who had installed the incorrect package and uploaded information to a remote server.
Vulnerability Detail
The malicious package in asnyc was designed to collect information from affected systems, including the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running as sudo. This information could potentially be used for malicious purposes. It is important to note that there is no further compromise beyond the data collection. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The asnyc package contained a malicious package that tracked users who installed the incorrect package. It collected information and uploaded it to a remote server. To mitigate this vulnerability, it is crucial to remove the package from dependencies and ensure correct package names are used during installation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for asnyc →
FAQ
The asnyc package is an open-source package available on the npm ecosystem. It provides asynchronous control flow with a simple and intuitive API.
Typosquatting is a technique used by attackers to register domain names or package names that are similar to popular ones, with the intention of tricking users who make typographical errors.
The malicious package in asnyc collected information such as the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running as sudo.
The collected information could potentially be used for malicious purposes, such as targeted attacks or identifying vulnerable systems.
No, there is no further compromise beyond the data collection. However, it is important to remove the malicious package and ensure the correct package is installed to prevent any potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for asnyc.
