Malicious code in frontend-components-react-transpiled (npm)
Summary
MAL-2023-8535: Malicious code in frontend-components-react-transpiled (npm). Affects frontend-components-react-transpiled versions 15.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'frontend-components-react-transpiled' is an npm package used for frontend development. It provides transpiled components for building user interfaces. The package is widely used in various projects and has a version 15.0.0 that has been identified as malicious by the OpenSSF Package Analysis project.
Vulnerability Detail
The version 15.0.0 of 'frontend-components-react-transpiled' has been flagged as malicious because it communicates with a domain associated with malicious activity. This indicates that the package may be compromised and could potentially introduce security risks to the applications using it. It is important to take immediate action to address this vulnerability to prevent any potential harm to the system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall frontend-components-react-transpiledIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best approach is to follow the steps mentioned in the 'how_to_fix' section to remove the malicious version and update to a safe version of 'frontend-components-react-transpiled'.
Conclusion
The 'frontend-components-react-transpiled' package version 15.0.0 has been identified as malicious. It is crucial to remove this version from the project dependencies and update to a safe version to mitigate any potential security risks. For further support and guidance, please contact DevNack.com.
See every vulnerability recorded for frontend-components-react-transpiled →
FAQ
'frontend-components-react-transpiled' is an npm package used for frontend development. It provides transpiled components for building user interfaces.
The OpenSSF Package Analysis project identified the malicious activity by analyzing the package's communication with a domain known for malicious activity.
Using the malicious version of the package can introduce security risks to the applications using it. It may lead to unauthorized access, data breaches, or other malicious activities.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using package-lock.json.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
