Malicious Package in carloprojectlesang
Summary
GHSA-qj2g-642f-4jrv: Malicious Package in carloprojectlesang. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The carloprojectlesang package is an open-source npm package that provides functionality for interacting with Discord user accounts. It allows users to perform various actions on their Discord accounts, such as making purchases. However, all versions of carloprojectlesang have been found to contain obfuscated malware that uploads Discord user tokens to a remote server.
Vulnerability Detail
The vulnerability in carloprojectlesang allows attackers to gain unauthorized access to Discord user accounts and potentially make purchases on behalf of the users. The malware within the package collects user tokens, which are used for authentication, and sends them to a remote server controlled by the attackers. This can lead to financial loss for users if they have credit cards linked to their Discord accounts. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The carloprojectlesang package contains obfuscated malware that poses a significant security risk to Discord users. It is crucial to remove the package, review account access, and rotate tokens to mitigate the potential impact. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for carloprojectlesang →
FAQ
carloprojectlesang is an npm package that provides functionality for interacting with Discord user accounts.
The malware in carloprojectlesang uploads Discord user tokens to a remote server controlled by attackers.
Attackers can use the user tokens to gain unauthorized access to Discord accounts and potentially make purchases on behalf of the users.
To fix this vulnerability, remove the carloprojectlesang package, review your Discord account access, and rotate tokens if possible.
If a credit card was linked to a compromised account, it is advised to contact your credit card company for further assistance.
References
Related vulnerabilities
Recent vulnerabilities recorded for carloprojectlesang.
