Malicious Code in ext-frontend-identity (npm)
Summary
MAL-2023-8516: Malicious code in ext-frontend-identity (npm). Affects ext-frontend-identity versions 7.1.1-develop.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ext-frontend-identity package is an npm package used for frontend identity management. It provides functionality for user authentication, authorization, and user profile management. The package is commonly used in web applications to handle user-related operations. However, the package has been identified as containing malicious code, which poses a security risk to applications that use it.
Vulnerability Detail
The ext-frontend-identity package at version 7.1.1-develop.9 has been flagged as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity. This indicates that the package may perform unauthorized actions or collect sensitive information from users. The presence of malicious code in the package can lead to various security risks, including data breaches, unauthorized access, and potential compromise of user accounts.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ext-frontend-identityIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the package from your application and update to a safe version as soon as possible.
Conclusion
The ext-frontend-identity package at version 7.1.1-develop.9 has been identified as containing malicious code. This poses a significant security risk to applications that use this package, including the potential compromise of user accounts and unauthorized access to sensitive information. It is crucial to remove the package from your application and update to a safe version as soon as possible. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ext-frontend-identity →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this malicious code in ext-frontend-identity.
The presence of malicious code in the ext-frontend-identity package can lead to various security risks, including data breaches, unauthorized access, and potential compromise of user accounts. The malicious code may perform unauthorized actions or collect sensitive information from users.
No, it is not recommended to use any version of the ext-frontend-identity package. The malicious code has been identified in version 7.1.1-develop.9, but it is possible that other versions may also be affected. It is best to remove the package entirely and find an alternative solution.
Yes, there are several alternative packages and libraries available for frontend identity management. Some popular options include 'passport' and 'jsonwebtoken'. It is recommended to evaluate these alternatives based on your specific requirements and choose a package with a good security track record.
For further support or assistance in fixing this vulnerability, you can reach out to info@devnack.com. They can provide guidance on vulnerability remediation and help ensure the security of your application.
