Malicious code in electorn: Critical Vulnerability
Summary
GHSA-38hx-3542-8fh3: Malicious code in electorn. Affects electorn versions < 10.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The electorn package is an npm package that was removed from the npm registry due to the presence of malicious code. It is used for certain functionalities in JavaScript applications. The package had a preinstall script that would write a public comment on GitHub, leaking sensitive information such as IP and IP-based geolocation, home directory name, and local username. The malicious packages have been removed from the npm registry and the leaked content has been removed from GitHub.
Vulnerability Detail
The vulnerability in the electorn package allowed for the execution of malicious code during the installation process. This code would write sensitive information to a public comment on GitHub, potentially exposing user data. The impact of this vulnerability could include privacy breaches, unauthorized access, and potential misuse of the leaked information. The vulnerability has been classified as critical.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the package to a non-affected version.
Conclusion
The electorn package had a critical vulnerability that allowed for the execution of malicious code during installation. This code leaked sensitive information to a public comment on GitHub. The vulnerability has been fixed by removing the malicious packages from the npm registry and removing the leaked content from GitHub. It is important to update the package to a non-affected version and regularly review package integrity to prevent similar vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for electorn →
FAQ
electorn is an npm package used for certain functionalities in JavaScript applications.
The vulnerability allowed for the execution of malicious code during installation, leading to the leakage of sensitive information.
Yes, the malicious packages have been removed from the npm registry and the leaked content has been removed from GitHub.
Regularly update packages and review their integrity to avoid potential vulnerabilities. Stay informed about security advisories and follow best practices for secure development.
For more information, you can visit the GitHub advisory database and search for the vulnerability ID GHSA-38hx-3542-8fh3.
References
Related vulnerabilities
Recent vulnerabilities recorded for electorn.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
