Malicious code in core-webpack (npm)
Summary
MAL-2024-1596: Malicious code in core-webpack (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The core-webpack package is an npm package that is used for webpack configuration in JavaScript projects. It provides a set of tools and utilities to optimize and bundle JavaScript code for web applications. This package is widely used in the JavaScript ecosystem for building and deploying web applications.
Vulnerability Detail
The core-webpack package has been found to contain malicious code. Any computer that has this package installed or running should be considered fully compromised. The malicious code can give full control of the computer to an outside entity, potentially leading to unauthorized access and data breaches. It is crucial to rotate all secrets and keys stored on the affected computer immediately from a different computer. Although removing the package is recommended, it may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall core-webpackIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
Conclusion
The core-webpack package has been found to contain malicious code, compromising the security of any computer with this package installed. It is crucial to take immediate action by rotating secrets and keys, removing the package, and conducting a thorough security audit. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for core-webpack →
FAQ
Core-webpack is an npm package used for webpack configuration in JavaScript projects. It helps optimize and bundle JavaScript code for web applications.
The malicious code in core-webpack can compromise your computer, giving full control to an outside entity. This can lead to unauthorized access, data breaches, and potential misuse of sensitive information.
If you have core-webpack installed on your computer, consider it fully compromised. Rotate all secrets and keys stored on that computer immediately from a different computer. Remove the core-webpack package and perform a thorough security audit.
While removing the core-webpack package is recommended, there is no guarantee that it will remove all malicious software resulting from its installation. A thorough security audit is necessary to ensure complete removal.
To prevent such vulnerabilities, regularly update your packages to the latest versions, use reputable sources for package installation, and perform security audits on your codebase.
