Malicious Package in font-scrubber
Summary
GHSA-65j7-66p7-9xgf: Malicious Package in font-scrubber. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The font-scrubber package is an npm package used for font sanitization and scrubbing. It is designed to remove any potentially harmful or malicious code from font files. The package is commonly used in web development projects to ensure the security and integrity of fonts used on websites. However, version 1.2.2 of the font-scrubber package contains a critical vulnerability that allows an attacker to upload sensitive files from the system to a remote server. This includes configuration files, command history logs, SSH keys, and the /etc/passwd file.
Vulnerability Detail
The vulnerability in font-scrubber version 1.2.2 is due to the presence of malicious code in the package's postinstall script. When the package is installed or running on a computer, it gives full control to an outside entity. This compromises the entire system, making it fully compromised. As a result, all secrets and keys stored on the affected computer should be rotated immediately from a different computer. Simply removing the package may not remove all the malicious software installed as a result of its installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
Version 1.2.2 of the font-scrubber package contains a critical vulnerability that compromises the entire system and allows an attacker to upload sensitive files to a remote server. It is crucial to identify and remove this package from all affected systems, rotate all sensitive information, and conduct a security audit. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for font-scrubber →
FAQ
Font-scrubber is an npm package used for font sanitization and scrubbing. It helps remove potentially harmful or malicious code from font files.
The vulnerability allows an attacker to upload sensitive files from the system to a remote server. This includes configuration files, command history logs, SSH keys, and the /etc/passwd file. It compromises the entire system, making it fully compromised.
To fix the vulnerability, you should identify all systems with the font-scrubber package version 1.2.2 installed, assume they are fully compromised, rotate all sensitive information from a different computer, and remove the font-scrubber package.
No, there is no known workaround for this vulnerability. It is recommended to follow the steps provided to fix the issue.
After removing the font-scrubber package, it is recommended to conduct a thorough security audit to identify any other potential compromises or vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for font-scrubber.
