Malicious code in console-webapp (npm)
Summary
MAL-2024-2019: Malicious code in console-webapp (npm). Affects console-webapp versions 1.0.0 – 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The console-webapp package is an npm package that provides a web application for managing console operations. It is commonly used in various projects to provide a user interface for interacting with the console. The package is vulnerable to a malicious code injection attack, which can lead to unauthorized access, data breaches, and other security issues.
Vulnerability Detail
The vulnerability in console-webapp (npm) is due to the presence of malicious code in the package. This code can be exploited by attackers to execute arbitrary commands, steal sensitive information, or perform other malicious activities. The malicious code was discovered by ReversingLabs and has been identified in versions 1.1.0 and 1.0.0 of the package. Users who have installed these versions are at risk of being affected by the vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall console-webappIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is crucial to update the package to a secure version as soon as possible.
Conclusion
The console-webapp package is vulnerable to a malicious code injection attack, which can lead to unauthorized access, data breaches, and other security issues. Users are advised to update to a secure version of the package as soon as possible to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for console-webapp →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the package-lock.json file of your application, and Vulert will analyze it and alert you if any open-source vulnerabilities, including this one, are found.
The potential consequences of this vulnerability include unauthorized access to sensitive information, data breaches, and the execution of arbitrary commands on the affected system. It is crucial to update the package to mitigate these risks.
No, only versions 1.1.0 and 1.0.0 of console-webapp are affected by this vulnerability. It is recommended to update to a secure version to ensure the safety of your application.
The maintainers of the console-webapp package have been notified about the presence of the malicious code and are actively working on removing it. It is important to update to a secure version once it becomes available.
If you have already installed an affected version of console-webapp, it is crucial to update to a secure version as soon as it becomes available. Additionally, you should monitor your system for any signs of unauthorized access or suspicious activities.
