Malicious Package in bs85check
Summary
GHSA-4hq8-v42x-9wx3: Malicious Package in bs85check. Affects bs85check versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bs85check package is an npm package used for a specific purpose. It has been found to contain malware that is designed to find and exfiltrate cryptocurrency wallets. This package is vulnerable to a critical security issue that compromises the security of the computer it is installed on.
Vulnerability Detail
The bs85check package, in all versions, contains malware that can compromise the security of the computer it is installed on. The malware is specifically designed to find and exfiltrate cryptocurrency wallets, putting the user's digital assets at risk. It is recommended to consider any computer with this package installed or running as fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The bs85check package has been found to contain malware that compromises the security of the computer it is installed on. It is crucial to take immediate action by considering the computer as fully compromised, rotating all secrets and keys, and removing the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bs85check →
FAQ
The bs85check package is an npm package used for a specific purpose.
This vulnerability can compromise the security of the computer it is installed on and can lead to the exfiltration of cryptocurrency wallets.
To fix this vulnerability, consider the computer as fully compromised, rotate all secrets and keys from a different computer, and remove the bs85check package.
No, there is no guarantee that removing the package will remove all malicious software resulting from its installation.
If you have this package installed, consider your computer as fully compromised, rotate all secrets and keys, and remove the bs85check package.
References
Related vulnerabilities
Recent vulnerabilities recorded for bs85check.
