Malware in pre-build binaries of bignum
Summary
GHSA-7cgc-fjv4-52x6: Malware in pre-build binaries of bignum. Affects bignum versions >= 0.12.2, < 0.13.1. Fixed in 0.13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bignum package is an npm package used for performing arbitrary-precision arithmetic in JavaScript. It provides a way to work with large numbers that exceed the limits of the built-in number type. The package is commonly used in applications that require cryptographic operations, such as encryption and digital signatures. However, versions of bignum from v0.12.2 to v0.13.0 (inclusive) are vulnerable to a malware injection attack.
Vulnerability Detail
The vulnerability in bignum arises from the use of node-pre-gyp to download pre-built binary versions of the addon. These binaries were hosted on an S3 bucket that has since been taken over by a malicious third party. The attacker has replaced the legitimate binaries with versions that contain malware. When users download and install these infected binaries, their computers become compromised, and the malware exfiltrates data from their systems. This poses a significant risk to the security and privacy of affected users.
How To Fix
Minimum fixed version
0.13.1
This is the first release that contains the fix.
npm install bignum@0.13.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The bignum package versions from v0.12.2 to v0.13.0 are vulnerable to a malware injection attack through the use of pre-built binaries. Users are advised to upgrade to version v0.13.1 or later, which eliminates the risk of downloading malicious code. It is crucial to take immediate action to protect the security and privacy of affected systems. For further support, contact DevNack.com.
See every vulnerability recorded for bignum →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities, including this one.
The malware injected into the pre-built binaries of bignum can exfiltrate sensitive data from the user's computer. This can include personal information, login credentials, financial data, or any other data stored on the compromised system. The consequences can range from identity theft to financial loss and unauthorized access to sensitive accounts or systems.
No, there is no workaround available for this vulnerability. The only solution is to upgrade to a non-vulnerable version of the bignum package.
There have been reports of the malicious binaries being served from the compromised S3 bucket. It is advisable to assume that any pre-built binaries downloaded from the affected versions of bignum are potentially compromised.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for bignum.
