CVE-2016-10620: Insecure Download of Executable in atom-node-module-installer
Summary
CVE-2016-10620: Downloads Resources over HTTP in atom-node-module-installer. Affects atom-node-module-installer versions < 0.9.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
atom-node-module-installer is an npm package that is used for installing Node.js modules in the Atom text editor. It provides a convenient way to manage dependencies and install modules directly within the Atom environment. However, this package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in atom-node-module-installer arises from the insecure download of an executable file. When the package attempts to download the executable, it does so over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running atom-node-module-installer. The package has not been updated since 2014, and no patch is currently available.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk of exploitation, it is recommended to uninstall atom-node-module-installer and use a different package for managing Node.js modules in the Atom text editor. This will eliminate the vulnerability associated with insecurely downloading executables over unencrypted HTTP connections.
Conclusion
The atom-node-module-installer package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. As no patch is available and the package has not been updated since 2014, it is recommended to avoid using this package and opt for an alternative. If you must use atom-node-module-installer, take precautions such as not installing it while connected to a public network. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for atom-node-module-installer →
FAQ
atom-node-module-installer is an npm package used for installing Node.js modules in the Atom text editor. It provides a convenient way to manage dependencies and install modules directly within the Atom environment.
The vulnerability allows an attacker with a privileged network position to intercept the download of an executable and replace it with a malicious one. This could result in code execution on the system running atom-node-module-installer.
No, there is currently no patch available for this vulnerability. The package has not been updated since 2014.
The best workaround is to avoid using atom-node-module-installer and use an alternative package for managing Node.js modules in the Atom text editor. If you must use atom-node-module-installer, ensure it is not installed while connected to a public network.
In order to exploit this vulnerability, an attacker needs to have a privileged network position or compromised access to your network or ISP. This could include nation-state actors or rogue ISP employees.
