Malicious Package in babel-laoder
Summary
GHSA-qp6m-jqfr-2f7v: Malicious Package in babel-laoder. Affects babel-laoder versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
babel-laoder is an npm package used for transpiling JavaScript code using Babel. It is commonly used in web development projects to convert modern JavaScript syntax into a compatible version that can run in older browsers. This package is widely used and trusted by developers for its ability to enhance cross-browser compatibility and improve code performance. However, all versions of this package were found to contain malware, which poses a significant security risk to any system that has it installed.
Vulnerability Detail
The malicious package in babel-laoder was specifically designed to find and exfiltrate cryptocurrency wallets. Once installed, it can give full control of the compromised computer to an external entity. This means that all secrets and keys stored on the affected computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of a malicious package in babel-laoder poses a critical security risk to systems that have it installed. It is crucial to take immediate action to mitigate the impact of this vulnerability. Rotate all affected secrets and keys, remove the package, and conduct a thorough security audit. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for babel-laoder →
FAQ
babel-laoder is an npm package used for transpiling JavaScript code using Babel. It helps convert modern JavaScript syntax into a compatible version for older browsers.
The impact of this vulnerability is severe. It can lead to the compromise of cryptocurrency wallets and the potential loss of funds. Additionally, the compromised system may be under the control of an external entity.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
If your system is affected, you should consider it fully compromised. Rotate all secrets and keys stored on the system from a different, secure computer. Remove the babel-laoder package and conduct a thorough security audit.
No, there is no guarantee that removing the babel-laoder package will remove all malicious software resulting from its installation. A thorough security audit is recommended to ensure complete removal.
References
Related vulnerabilities
Recent vulnerabilities recorded for babel-laoder.
