Critical Vulnerability in aysnc Package
Summary
GHSA-gfjr-xqhm-qvv3: Malicious Package in aysnc. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aysnc package is an open-source npm package that provides asynchronous control flow and utility functions for JavaScript. It is commonly used in Node.js applications to handle asynchronous operations. However, all versions of the aysnc package were found to contain a malicious package that was typosquatted on a popular package of a similar name. This malicious package tracked users who had installed the incorrect package and uploaded information to a remote server. The uploaded information included the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running as sudo. It is important to note that there is no further compromise beyond the data collection.
Vulnerability Detail
The vulnerability in the aysnc package arises from the presence of the malicious package that was typosquatted. This package was designed to deceive users who mistyped the package name during installation. By tracking the users who installed the incorrect package, the malicious actors behind the package were able to collect sensitive information. This includes the names of the downloaded and intended packages, as well as system-related details such as the Node version and sudo privileges. The potential ramifications of this vulnerability include privacy breaches, data leakage, and potential misuse of the collected information. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, following the recommended steps to fix the vulnerability should be sufficient.
Conclusion
The aysnc package was found to contain a critical vulnerability due to the presence of a malicious package that tracked users who installed it. This vulnerability could lead to privacy breaches and data leakage. To mitigate the risk, it is important to remove the package from your dependencies and ensure correct package name typing during installation. Regularly updating packages is also advised. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aysnc →
FAQ
The aysnc package is a popular npm package used for handling asynchronous control flow and providing utility functions in JavaScript and Node.js applications.
The malicious package in aysnc tracked users by collecting information about the downloaded package, the intended package, the Node version, and whether the process was running as sudo. This information was then uploaded to a remote server.
The potential consequences of this vulnerability include privacy breaches, data leakage, and potential misuse of the collected information.
This vulnerability is rated as critical with a CVSS score of 9.8.
To fix this vulnerability, remove the aysnc package from your dependencies and ensure that package names are typed correctly during installation. Regularly updating your packages is also recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for aysnc.
