Malicious Package in donotinstallthis - Critical Vulnerability
Summary
GHSA-73hr-6785-f5p8: Malicious Package in donotinstallthis. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The donotinstallthis package is an npm package that was found to contain malicious code. This package is used in various projects and installations. It is important to note that the package itself is not intended for use and should be removed from your environment.
Vulnerability Detail
The donotinstallthis package contained a script that was executed during the installation process. This script made contact with a remote service to track the number of installations. While there is no evidence of further compromise, the presence of this malicious code poses a significant security risk. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The donotinstallthis package contained malicious code that posed a critical security risk. It is recommended to remove this package from your environment to ensure the security of your applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for donotinstallthis →
FAQ
The presence of the malicious code in the donotinstallthis package can lead to unauthorized tracking of installations. While there is no evidence of further compromise, it is important to remove the package to ensure the security of your environment.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There is no specific workaround available for this vulnerability. The recommended solution is to remove the donotinstallthis package from your environment.
The malicious code was found specifically in the donotinstallthis package. Other packages from the same author may not be affected. However, it is recommended to exercise caution and thoroughly review any packages from the same author before using them.
To prevent similar vulnerabilities, it is important to follow best practices for package management. Regularly update your packages to the latest versions, review the package's source code and community feedback, and consider using tools like Vulert to monitor and alert for open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for donotinstallthis.
