Malicious Package in calk
Summary
GHSA-9mmw-3fmh-96g3: Malicious Package in calk. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The calk package is an npm package that provides functionality for performing calculations. It is commonly used in Node.js applications for mathematical operations. However, all versions of calk were found to have a vulnerability where a malicious package with a similar name was typosquatted. This malicious package tracked users who installed it and uploaded information to a remote server. The uploaded information included the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running as sudo. It is important to remove this package from your dependencies and ensure correct package names are used during installation.
Vulnerability Detail
The vulnerability in the calk package arises from the typosquatting of a popular package with a similar name. Users who mistakenly install the malicious package have their information tracked and uploaded to a remote server. Although there is no further compromise reported, this can lead to potential privacy and security risks. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The calk package has a critical vulnerability where a malicious package with a similar name tracks users and uploads their information to a remote server. To mitigate this vulnerability, it is important to remove the package from your dependencies and ensure correct package names are used during installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for calk →
FAQ
The calk package is used for performing calculations in Node.js applications.
The malicious package tracks users by uploading information to a remote server, including the name of the downloaded package, the name of the intended package, the Node version, and whether the process is running as sudo.
Installing the malicious package can lead to privacy and security risks as the user's information is tracked and uploaded to a remote server.
No further compromise has been reported beyond the information tracking.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for calk.
