Malicious Package in axioss
Summary
GHSA-8w9j-6wg6-qv4f: Malicious Package in axioss. Affects axioss versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
axioss is an npm package used for making HTTP requests from Node.js or browser-based applications. It provides a simple and intuitive API for sending and receiving data. However, the axioss package has been found to contain malicious code that uploads system information to a remote server.
Vulnerability Detail
The axioss package, starting from version 0.0.0, includes a malicious payload that collects sensitive system information such as the operating system and hostname. This information is then sent to a remote server without the user's consent or knowledge. The presence of this malicious code poses a significant security risk as it can lead to unauthorized access, data breaches, and potential compromise of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The axioss package contains a malicious payload that uploads system information to a remote server. To protect your system and prevent unauthorized access, it is essential to remove the axioss package from your environment. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for axioss →
FAQ
The vulnerability allows an attacker to collect sensitive system information from the affected system and transmit it to a remote server. This can lead to unauthorized access, data breaches, and potential compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
There is no known workaround for this vulnerability. The recommended solution is to remove the axioss package from your environment.
There are no indications of further compromise beyond the collection and transmission of system information. However, it is crucial to remove the axioss package to mitigate any potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for axioss.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
