Malicious Package in deasyncp - Critical Vulnerability
Summary
GHSA-qfc9-x7gv-27jr: Malicious Package in deasyncp. Affects deasyncp versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
deasyncp is an npm package that provides asynchronous versions of JavaScript functions. It is commonly used to simplify the handling of synchronous code in Node.js applications. However, all versions of deasyncp contain malicious code that triggers a machine shutdown upon installation as a preinstall script.
Vulnerability Detail
The vulnerability in deasyncp arises from the presence of malicious code within the package. When the package is installed, the preinstall script is executed, resulting in the shutdown of the machine. This can lead to significant disruption and potential data loss. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The deasyncp package contains a critical vulnerability that triggers a machine shutdown upon installation. To mitigate this risk, it is crucial to remove the package from your environment. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for deasyncp →
FAQ
deasyncp is an npm package that provides asynchronous versions of JavaScript functions.
The impact of this vulnerability is the shutdown of the machine upon installation of the deasyncp package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and you can simply input your package-lock.json file to get real-time alerts for open-source vulnerabilities.
No workaround is available for this vulnerability. It is recommended to remove the deasyncp package from your environment.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-qfc9-x7gv-27jr/GHSA-qfc9-x7gv-27jr.json
References
Related vulnerabilities
Recent vulnerabilities recorded for deasyncp.
