Malicious Package in flatmap-stream
Summary
GHSA-9x64-5r7x-2q53: Malicious Package in flatmap-stream. Affects flatmap-stream versions 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The flatmap-stream package is an npm module that is used for manipulating streams of data in JavaScript applications. It provides a way to transform and process data in a stream-like fashion. The package is widely used in various projects and has been a trusted dependency for a long time. However, version 0.1.1 of flatmap-stream has been identified as a malicious package.
Vulnerability Detail
The malicious version of flatmap-stream contains an encrypted payload that specifically targets the copay application. The package disguises itself as a test fixture and performs several malicious actions. It reads in AES encrypted data from a file, grabs the npm package description of the module that imported it, and uses it as a key to decrypt a chunk of data from the file. This decrypted data is then compiled in memory and executed. The malicious code detects the current environment and checks the Bitcoin and Bitcoin Cash balances on the victim's copay account. If the balance exceeds certain thresholds, it harvests the victim's account data and private keys, sending them off to a collection. This vulnerability poses a significant risk to users of the copay application, potentially resulting in the loss of their account data and funds.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to remove the malicious package and replace it with a trusted version of flatmap-stream.
Conclusion
The malicious package in flatmap-stream poses a critical security risk to users of the copay application. It is crucial to remove the malicious version and replace it with a trusted version to protect user data and funds. Stay vigilant by regularly checking for updates and security advisories, and consider using vulnerability monitoring tools like Vulert to ensure real-time protection against open-source vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for flatmap-stream →
FAQ
flatmap-stream is an npm module used for manipulating streams of data in JavaScript applications. It provides a way to transform and process data in a stream-like fashion.
The malicious version of flatmap-stream contains an encrypted payload that specifically targets the copay application. It disguises itself as a test fixture and performs various actions to decrypt and execute the malicious code.
The malicious code checks the Bitcoin and Bitcoin Cash balances on the victim's copay account. If the balance exceeds certain thresholds, it harvests the victim's account data and private keys, sending them off to a collection.
To fix this vulnerability, it is recommended to remove the malicious version of flatmap-stream from your environment and replace it with a trusted version. Stay updated with security advisories and consider using vulnerability monitoring tools like Vulert to receive real-time alerts for open-source vulnerabilities.
There is no specific workaround mentioned for this vulnerability. The best course of action is to remove the malicious package and replace it with a trusted version of flatmap-stream.
References
Related vulnerabilities
Recent vulnerabilities recorded for flatmap-stream.
