Malicious Package in asymc
Summary
GHSA-x6ch-c6rv-f7wh: Malicious Package in asymc. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The asymc package is an open-source npm package that provides functionality for asymmetric cryptography. It is commonly used in Node.js applications for tasks such as generating and verifying digital signatures, encrypting and decrypting data, and key management. However, all versions of asymc were found to contain a malicious package that was typosquatted on a popular package of similar name. This malicious package tracked users who had installed it and uploaded information to a remote server. The uploaded information included the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running as sudo. It is important to note that there is no further compromise beyond the data collection.
Vulnerability Detail
The vulnerability in the asymc package arises from the inclusion of a malicious package that masquerades as a legitimate package. This typosquatting technique tricks users into installing the incorrect package, allowing the attacker to gather information about the affected system. The uploaded data includes sensitive information such as the names of the downloaded and intended packages, the Node version, and the privilege level of the process. This vulnerability poses a significant risk to the confidentiality and integrity of the affected system, as the collected data can be used for further targeted attacks or exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, following the recommended steps to fix the vulnerability should be sufficient to mitigate the risk.
Conclusion
The asymc package was found to contain a malicious package that tracked users who installed it. The collected data included sensitive information about the system. To mitigate this vulnerability, it is recommended to remove the package from your dependencies and ensure correct package names during installation. Regularly updating packages is also important to stay protected against such attacks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for asymc →
FAQ
Typosquatting is a technique used by attackers to register domain names or package names that are similar to popular ones, with the intention of tricking users into installing or visiting the malicious version.
The malicious package in asymc collects the name of the downloaded package, the name of the intended package, the Node version, and whether the process is running as sudo.
The collected information can be used by attackers for targeted attacks or exploitation. This can include identifying vulnerable systems, tailoring attacks based on the Node version, or leveraging sudo privileges for further compromise.
To avoid falling victim to typosquatting, always double-check the package name before installation. Pay attention to any slight variations or misspellings that may indicate a malicious version.
No, there is no evidence of further compromise beyond the data collection. However, it is crucial to remove the malicious package and take necessary precautions to protect your system.
References
Related vulnerabilities
Recent vulnerabilities recorded for asymc.
