Malicious Package in coinstrng
Summary
GHSA-hj5w-xgw9-w4rj: Malicious Package in coinstrng. Affects coinstrng versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
coinstrng is an npm package that is used for generating random strings. It provides a simple and convenient way to generate random strings for various purposes. However, all versions of this package were found to contain malware. The package was specifically designed to find and exfiltrate cryptocurrency wallets, posing a significant security risk to any computer that has this package installed or running.
Vulnerability Detail
The vulnerability in coinstrng arises from the presence of malware within the package. This malware is capable of searching for and stealing cryptocurrency wallets, potentially leading to financial loss for the affected users. It is important to note that any computer with this package installed should be considered fully compromised, and all secrets and keys stored on that computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software, as the attacker may have gained full control of the compromised computer.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of malware in the coinstrng package poses a critical security risk to any computer that has it installed or running. It is crucial to take immediate action by rotating all secrets and keys, removing the package, and conducting a security audit. Keeping all software and packages up to date is also essential to prevent future vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for coinstrng →
FAQ
coinstrng is an npm package used for generating random strings.
The impact of this vulnerability is significant as it can lead to the theft of cryptocurrency wallets and potential financial loss.
You can use Vulert's playground (https://vulert.com/scanner) to check if your computer is affected by this vulnerability. It requires no signup and uses package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to follow the steps mentioned in the 'How to Fix' section.
No, removing the coinstrng package may not guarantee the removal of all malicious software. It is advised to conduct a thorough security audit to identify any other potential compromises or vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for coinstrng.
