Malicious code in docusaurus-plugin-matamoh (npm)
Summary
MAL-2023-8610: Malicious code in docusaurus-plugin-matamoh (npm). Affects docusaurus-plugin-matamoh versions 22.2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The docusaurus-plugin-matamoh package is an npm package used in the Docusaurus documentation framework. It provides a plugin that allows users to embed Matamoh code snippets in their documentation. Matamoh is a code execution tool that enables users to execute code snippets directly within the documentation. This package is vulnerable to a malicious code injection.
Vulnerability Detail
The docusaurus-plugin-matamoh package has been compromised with malicious code. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall docusaurus-plugin-matamohIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
Conclusion
The docusaurus-plugin-matamoh package has been compromised with malicious code, and any computer with this package installed or running should be considered fully compromised. It is crucial to follow the steps provided in the 'how_to_fix' section to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for docusaurus-plugin-matamoh →
FAQ
Docusaurus-plugin-matamoh is an npm package used in the Docusaurus documentation framework. It provides a plugin for embedding Matamoh code snippets in documentation.
Matamoh is a code execution tool that allows users to execute code snippets directly within documentation.
If you have the docusaurus-plugin-matamoh package installed or running on your computer, it should be considered compromised. It is recommended to rotate all secrets and keys stored on that computer from a different computer.
There is no guarantee that removing the docusaurus-plugin-matamoh package will remove all malicious software resulting from installing it. It is recommended to run a thorough malware scan on the computer.
Yes, the recommended fix is to rotate all secrets and keys stored on the compromised computer, remove the docusaurus-plugin-matamoh package, and run a thorough malware scan.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
