Malicious Package in electron-native-notify
Summary
GHSA-j8qr-rvcv-crhv: Malicious Package in electron-native-notify. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The electron-native-notify package is an open-source package available on the npm registry. It is designed to provide native notifications for Electron applications. This package allows developers to display system notifications on Windows, macOS, and Linux platforms. However, all versions of electron-native-notify have been found to contain malicious code.
Vulnerability Detail
The malicious code present in electron-native-notify was part of a targeted attack aimed at stealing cryptocurrency wallet seeds. The code uploads the stolen seeds to a remote server, giving attackers access to users' wallets. This vulnerability poses a significant risk to users who have installed and used this package, as it can result in the loss of their cryptocurrency assets.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The electron-native-notify package has been found to contain malicious code that can lead to the theft of cryptocurrency wallet seeds. It is crucial to remove this package from your environment and follow the recommendations provided by Komodo to protect your assets. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for electron-native-notify →
FAQ
electron-native-notify is an open-source package that enables developers to display native notifications in Electron applications on various operating systems.
The vulnerability allows attackers to steal cryptocurrency wallet seeds, potentially resulting in the loss of users' cryptocurrency assets.
To protect yourself, it is recommended to remove the electron-native-notify package from your environment and follow the recommendations provided by Komodo.
Yes, the fix for this vulnerability involves removing the affected package and following the recommendations provided by Komodo.
Yes, all versions of electron-native-notify are found to contain the malicious code.
Related vulnerabilities
Recent vulnerabilities recorded for electron-native-notify.
