Malicious Package in file-logging
Summary
GHSA-wwwg-6r7f-9c9h: Malicious Package in file-logging. Affects file-logging versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The file-logging package is an npm package used for logging purposes. It provides functionality to log system information such as OS and hostname. However, a specific version of this package (0.0.0) has been found to contain malicious code. When this package is installed, it uploads the system information to a remote server without the user's consent or knowledge.
Vulnerability Detail
The vulnerability in the file-logging package allows an attacker to gather sensitive system information from the host machine and send it to a remote server. This can lead to privacy breaches and potential unauthorized access to the system. The malicious code is embedded in the package and is executed when the package is installed or used. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The file-logging package has been found to contain a malicious package version (0.0.0) that uploads system information to a remote server. To mitigate this vulnerability, it is crucial to remove the package from your environment and consider using alternative logging packages from trusted sources. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for file-logging →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
The malicious package in file-logging can compromise the privacy of system information and potentially lead to unauthorized access to the host machine. This can result in data breaches, system compromise, and further exploitation of the affected system.
The specific version 0.0.0 of file-logging is known to contain the malicious code. It is recommended to remove this version and avoid using it. It is important to always review the package's source and consider using packages from trusted sources to minimize the risk of such vulnerabilities.
There are no indications of further compromise beyond the malicious code present in the file-logging package. However, it is advisable to thoroughly review your system for any suspicious activities or unexpected behavior, and consider conducting a security audit to ensure the integrity of your environment.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. This indicates a high level of risk and the potential for significant impact on the affected systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for file-logging.
