CVE-2022-2233: Malicious code in creathash (npm)
Summary
MAL-2022-2233: Malicious code in creathash (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The creathash package is an npm package used for creating hash values. It is commonly used in various applications and systems for cryptographic operations. The package provides a simple and convenient way to generate hash values for data. However, the package has been found to contain malicious code, which can compromise the security of any system where it is installed or running.
Vulnerability Detail
The creathash package has been identified as containing malicious code. This code can give full control of the affected computer to an outside entity, compromising the confidentiality and integrity of the system. Any secrets and keys stored on the compromised computer should be rotated immediately from a different computer. Simply removing the package may not be sufficient, as there is no guarantee that all malicious software resulting from its installation will be removed. The presence of this package on a computer should be considered a full compromise, and appropriate actions should be taken to mitigate the risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall creathashIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to follow the steps outlined in the 'how_to_fix' section.
Conclusion
The creathash package has been found to contain malicious code, compromising the security of any system where it is installed or running. It is crucial to take immediate action to rotate all secrets and keys, remove the package, and perform a thorough security audit. Keeping software and packages up to date is essential to prevent similar incidents in the future. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for creathash →
FAQ
The impact of this vulnerability is that an outside entity can gain full control of the affected computer, compromising the confidentiality and integrity of the system. Any secrets and keys stored on the compromised computer should be rotated immediately from a different computer.
To fix this vulnerability, it is recommended to rotate all secrets and keys stored on the affected computer from a different, secure computer. Remove the creathash package from the system and perform a thorough security audit to identify any other potential compromises or vulnerabilities.
Simply removing the package may not be sufficient, as there is no guarantee that all malicious software resulting from its installation will be removed. It is important to rotate all secrets and keys stored on the affected computer and perform a thorough security audit.
To prevent similar incidents in the future, it is important to keep all software and packages up to date. Regularly check for security updates and patches, and follow best practices for secure coding and system administration.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
