CVE-2022-2059: Malicious code in com.unity.git (npm)
Summary
MAL-2022-2059: Malicious code in com.unity.git (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The com.unity.git package is an npm package that is used in Unity projects for version control and collaboration. It provides functionality for managing Git repositories within the Unity development environment. This package is widely used by developers working on Unity projects to track changes, manage branches, and collaborate with other team members. However, the com.unity.git package has been found to contain malicious code, which poses a significant security risk to any computer that has this package installed or running.
Vulnerability Detail
The com.unity.git package has been compromised and contains malicious code. This vulnerability, identified as CVE-2022-2059, allows an attacker to gain full control of the computer on which the package is installed. Any secrets and keys stored on that computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation. The malicious code can potentially lead to unauthorized access, data theft, and other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall com.unity.gitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to follow the recommended steps for fixing the vulnerability and ensuring the security of the affected computer.
Conclusion
The com.unity.git package has been found to contain malicious code, posing a significant security risk to any computer with the package installed. It is crucial to take immediate action to rotate secrets and keys, remove the package, and conduct a security audit. Installing a trusted version of the package and keeping all software up to date will help mitigate future vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.unity.git →
FAQ
com.unity.git is an npm package used in Unity projects for version control and collaboration.
This vulnerability allows an attacker to gain full control of the computer on which the com.unity.git package is installed. It can lead to unauthorized access, data theft, and other malicious activities.
To fix this vulnerability, rotate all secrets and keys stored on the affected computer, remove the com.unity.git package, conduct a security audit, install a trusted version of the package, and keep all software up to date.
No specific workaround is provided. It is important to follow the recommended steps for fixing the vulnerability.
To prevent similar vulnerabilities, regularly update software and packages, use trusted sources for package installation, and conduct security audits to identify and address potential risks.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
