Malicious Package in eact: Tracking and Information Leakage
Summary
GHSA-pmgv-94f5-6w7w: Malicious Package in eact. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The eact package is an open-source library available on the npm ecosystem. It provides functionality for building user interfaces in JavaScript applications. The package is widely used by developers to create interactive and dynamic web applications. Unfortunately, all versions of eact were found to contain a malicious package that was designed to mimic a popular package with a similar name. This malicious package tracked users who mistakenly installed it and collected sensitive information from their systems. The package uploaded data to a remote server, including the name of the downloaded package, the intended package name, the Node version, and whether the process was running with sudo privileges. This vulnerability poses a significant risk to users who inadvertently installed the malicious package.
Vulnerability Detail
The vulnerability in the eact package arises from the inclusion of a malicious package that masquerades as a legitimate package. This typosquatting technique tricks users into installing the incorrect package, which then proceeds to collect and transmit sensitive information to a remote server. The uploaded data includes details about the downloaded package, the intended package, the Node version, and the execution context. The impact of this vulnerability can be severe, as it compromises the privacy and security of affected systems. The collected information could potentially be used for further attacks or unauthorized access. It is important to note that there is no evidence of any additional compromise beyond the information leakage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, following the recommended steps to fix the vulnerability should effectively mitigate the risk.
Conclusion
The eact package was found to contain a malicious package that tracked users who mistakenly installed it. This package collected sensitive information and transmitted it to a remote server. To mitigate this vulnerability, it is crucial to remove the eact package from your project's dependencies and ensure correct package names during installation. Regularly updating dependencies is also recommended to stay protected against potential vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for eact →
FAQ
Installing the malicious package can result in the leakage of sensitive information from your system. This includes details about the downloaded package, the intended package, the Node version, and the execution context. The collected information could potentially be used for further attacks or unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file to identify and alert you about open-source vulnerabilities in your software.
No, there is no evidence of any additional compromise beyond the information leakage. However, it is crucial to address this vulnerability promptly to prevent any potential misuse of the leaked information.
If you have installed the malicious package, it is recommended to remove it from your project's dependencies immediately. Additionally, consider reviewing your system for any suspicious activities or unauthorized access.
To prevent the accidental installation of malicious packages, always double-check the package names before installing dependencies. Typing package names correctly and verifying their authenticity can help mitigate the risk of installing malicious packages.
References
Related vulnerabilities
Recent vulnerabilities recorded for eact.
