Malicious Package in exprss
Summary
GHSA-6qc7-jgq7-34rf: Malicious Package in exprss. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The exprss package is an open-source npm package used for building web applications with Node.js. It provides a framework for creating web servers and handling HTTP requests. The package is widely used and has been trusted by developers for its simplicity and ease of use. However, all versions of exprss were found to contain a malicious package that was typosquatted, leading to potential security risks for users who installed the incorrect package.
Vulnerability Detail
The malicious package uploaded sensitive information to a remote server, including the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running with sudo privileges. This information could be used for further attacks or tracking of users. The vulnerability has a CVSS score of 9.8, indicating its critical severity. It is important to note that there is no evidence of further compromise beyond the data collection.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The exprss package contained a malicious package that collected sensitive information from users. To mitigate the risk, it is crucial to remove the package from your dependencies and ensure correct package names during installation. Regularly updating packages is also recommended to stay protected against known vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for exprss →
FAQ
The exprss package is used for building web applications with Node.js. It provides a framework for creating web servers and handling HTTP requests.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and Vulert will analyze it in real-time.
The malicious package collected the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running with sudo privileges.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
No, there is no evidence of further compromise beyond the data collection.
References
Related vulnerabilities
Recent vulnerabilities recorded for exprss.
