Malicious Package in browserift - Critical Vulnerability
Summary
GHSA-43vf-2x6g-p2m5: Malicious Package in browserift. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The browserift package is an npm package used for browserify transforms. It allows developers to bundle JavaScript modules for use in the browser. The package is widely used in web development projects and provides a convenient way to package and optimize code for client-side execution. However, version 16.3.3 of browserift contained a malicious code as a preinstall script. This backdoor package opened a connection to a remote server and executed incoming commands on both Unix and Windows machines.
Vulnerability Detail
The malicious code in version 16.3.3 of browserift poses a significant security risk. Any computer that has this package installed or running should be considered fully compromised. The backdoor package gives complete control of the computer to an outside entity, allowing them to execute commands and potentially access sensitive information. It is crucial to rotate all secrets and keys stored on the compromised computer immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Unfortunately, there is no known workaround for this vulnerability. It is crucial to remove the affected version of browserift from all systems and follow the recommended steps to mitigate the security risk.
Conclusion
The presence of a malicious package in version 16.3.3 of browserift poses a critical security risk. Any system with this package installed or running should be considered compromised. It is essential to remove the package, rotate all secrets and keys, and conduct a thorough security audit to mitigate the risk. Implementing additional security measures and following best practices can help prevent similar incidents in the future. For further support and guidance, contact DevNack.com.
See every vulnerability recorded for browserift →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
If your system is compromised, it is crucial to take immediate action. Follow the steps mentioned in the 'how_to_fix' section to remove the affected package, rotate all secrets and keys, and conduct a thorough security audit.
While removing the affected package is necessary, it may not guarantee the complete removal of all malicious software resulting from its installation. It is recommended to conduct a thorough security audit and implement additional security measures to ensure the system's integrity.
To prevent similar incidents, consider implementing additional security measures such as intrusion detection systems, regular vulnerability scanning, and following best practices for secure software development and package management.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide expert guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for browserift.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
