Malicious Package in bs85 - Cryptocurrency Wallet Exfiltration
Summary
GHSA-gvm7-8fq3-qjj2: Malicious Package in bs85. Affects bs85 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bs85 is an npm package that is used for [provide brief description of the package functionality and key attributes]. It is vulnerable to a critical security issue that involves the presence of malware within the package. The malware is specifically designed to find and exfiltrate cryptocurrency wallets.
Vulnerability Detail
The vulnerability in bs85 arises from the inclusion of a malicious package that contains malware. This malware can compromise the security of any computer that has the package installed or running. It is capable of extracting sensitive information, such as cryptocurrency wallets, from the compromised system. The presence of this package on a computer should be considered a full compromise, and all secrets and keys stored on that computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of a malicious package in bs85 poses a critical security risk, potentially compromising the security of computers where it is installed. It is crucial to take immediate action by rotating compromised secrets and keys, removing the package, and conducting a thorough security audit. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bs85 →
FAQ
[Provide a brief description of bs85 and its purpose.]
[Explain how the malware in the package operates and the potential impact on security.]
If you have the bs85 package installed, you should consider your computer as fully compromised. Rotate all secrets and keys stored on that computer from a different computer and remove the bs85 package. Conduct a thorough security audit to ensure the removal of any remaining malicious software.
No, removing the bs85 package does not guarantee the removal of all malicious software resulting from its installation. A thorough security audit is recommended to ensure complete removal.
To prevent this vulnerability, it is important to regularly update and monitor the packages used in your software. Stay informed about any security advisories or vulnerabilities associated with the packages you use and take appropriate actions, such as updating to patched versions or finding alternative packages.
References
Related vulnerabilities
Recent vulnerabilities recorded for bs85.
