Malicious Package in eslint-scope
Summary
GHSA-hxxf-q3w9-4xgw: Malicious Package in eslint-scope. Affects eslint-scope versions >= 3.7.2, < 3.7.3. Fixed in 3.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package eslint-scope is an open-source library used for static analysis of JavaScript code. It provides scope analysis for ESLint, a popular JavaScript linting tool. The library is widely used in the JavaScript ecosystem and is a critical component for ensuring code quality and adherence to coding standards. However, version 3.7.2 of eslint-scope was published without authorization and contained malicious code.
Vulnerability Detail
The unauthorized version 3.7.2 of eslint-scope contained code that would read the user's .npmrc file and send any found authentication tokens to two remote servers. This vulnerability posed a significant risk to the security and privacy of users who had installed this version of the package. The malicious code could potentially lead to unauthorized access to sensitive information and compromise the security of the affected systems.
How To Fix
Minimum fixed version
3.7.3
This is the first release that contains the fix.
npm install eslint-scope@3.7.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The malicious package in eslint-scope version 3.7.2 posed a critical security risk by reading the user's .npmrc file and sending authentication tokens to remote servers. To mitigate this vulnerability, it is crucial to update to version 3.7.3 or later and revoke all npm tokens. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for eslint-scope →
FAQ
eslint-scope is an open-source library used for static analysis of JavaScript code. It provides scope analysis for ESLint, a popular JavaScript linting tool.
The malicious package, version 3.7.2 of eslint-scope, could read the user's .npmrc file and send authentication tokens to remote servers. This could potentially lead to unauthorized access to sensitive information and compromise the security of affected systems.
To fix the vulnerability, update eslint-scope to version 3.7.3 or later. Additionally, it is recommended to revoke all npm tokens as a precautionary measure.
No specific workarounds are mentioned for this vulnerability. Updating to a fixed version of eslint-scope is the recommended solution.
Instructions on how to revoke npm tokens can be found in the npm documentation: https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
