Malicious Code in flink-dashboard (npm)
Summary
MAL-2023-8502: Malicious code in flink-dashboard (npm). Affects flink-dashboard versions 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
flink-dashboard is an npm package that provides a dashboard for Apache Flink, an open-source stream processing framework. It allows users to monitor and manage Flink applications through a web interface. However, the package version 2.0.1 has been identified as malicious by the OpenSSF Package Analysis project.
Vulnerability Detail
The package has been flagged as malicious because it communicates with a domain associated with malicious activity. This indicates that the package may be compromised and could potentially perform unauthorized actions or collect sensitive information from the user's system. It is important to note that using this package version puts the user's system at risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall flink-dashboardIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The flink-dashboard package version 2.0.1 has been identified as malicious. It is crucial to remove this version from your project and update to a trusted version to mitigate the risk of unauthorized actions and data compromise. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for flink-dashboard →
FAQ
flink-dashboard is an npm package that provides a web-based dashboard for managing Apache Flink applications.
Using the malicious version of flink-dashboard puts your system at risk of unauthorized actions and potential data compromise.
You can check your project's package.json file or package-lock.json file to see if the version 2.0.1 of flink-dashboard is listed in the dependencies.
Yes, there are alternative dashboard packages available for Apache Flink. You can explore other trusted packages in the npm registry or consider using the official Flink web interface.
You can find more information about the OpenSSF Package Analysis project on their GitHub repository and join their Slack channel for discussions and updates.
