Malicious code in docusaurus-plugin-matamohnhb (npm)
Summary
MAL-2023-8611: Malicious code in docusaurus-plugin-matamohnhb (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The docusaurus-plugin-matamohnhb package is an npm package used in the Docusaurus documentation framework. It is designed to provide additional functionality and features to Docusaurus websites. This package is vulnerable to a malicious code injection attack.
Vulnerability Detail
The vulnerability in docusaurus-plugin-matamohnhb is due to the presence of malicious code within the package. This code can compromise the security of any computer that has the package installed or running. It is recommended to consider any computer with this package as fully compromised. The malicious code can give an outside entity full control of the computer, potentially exposing any secrets and keys stored on that machine. Removing the package may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall docusaurus-plugin-matamohnhbIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to follow the steps outlined in the 'how_to_fix' section.
Conclusion
The docusaurus-plugin-matamohnhb package is vulnerable to a malicious code injection attack. It is crucial to take immediate action to mitigate the risk. Rotate all secrets and keys stored on affected computers, remove the package, and thoroughly scan and clean the machines using reliable security tools. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for docusaurus-plugin-matamohnhb →
FAQ
Docusaurus-plugin-matamohnhb is an npm package used in the Docusaurus documentation framework. It provides additional functionality and features to Docusaurus websites.
The malicious code in docusaurus-plugin-matamohnhb can compromise the security of any computer that has the package installed or running. It can give an outside entity full control of the computer and potentially expose any secrets and keys stored on that machine.
If you have the docusaurus-plugin-matamohnhb package installed, it is recommended to consider your computer as fully compromised. Rotate all secrets and keys stored on that computer from a different machine and remove the package. However, note that removing the package may not completely remove all malicious software that may have been installed.
To ensure the complete removal of malicious software resulting from the docusaurus-plugin-matamohnhb package, it is recommended to thoroughly scan and clean the affected computer using reliable security tools.
For more information about this vulnerability, you can visit the GitHub repository of the malicious-packages project: https://github.com/ossf/malicious-packages
