Malicious code in generate-protocol (npm)
Summary
MAL-2024-2415: Malicious code in generate-protocol (npm). Affects generate-protocol versions 6.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The generate-protocol package is an npm package used for generating protocol buffers. It is commonly used in applications that require efficient serialization and deserialization of structured data. The package provides a set of tools and utilities for working with protocol buffers, including code generation and validation. However, a vulnerability has been discovered in the package that allows for the execution of malicious code.
Vulnerability Detail
The vulnerability, identified as MAL-2024-2415, originates from a malicious code injection in the generate-protocol package. The code injection occurs in version 6.0.2 of the package, which has been flagged as malicious by ReversingLabs. This malicious code can be exploited by an attacker to execute arbitrary commands on the affected system. The ramifications of this vulnerability include potential unauthorized access, data breaches, and system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall generate-protocolIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can uninstall the affected version (6.0.2) of generate-protocol and install a previous version that is known to be secure. For example, version 5.2.1 does not contain the malicious code. The following commands can be used to uninstall and install the specific version:
Uninstall: npm uninstall generate-protocol@6.0.2 Install secure version: npm install generate-protocol@5.2.1
Conclusion
The generate-protocol package has been found to contain a malicious code injection vulnerability in version 6.0.2. This vulnerability can be exploited to execute arbitrary code on the affected system, potentially leading to unauthorized access and data breaches. It is crucial to update to a secure version of the package and review the package's source code and dependencies for any other potential security issues.
See every vulnerability recorded for generate-protocol →
FAQ
Generate-protocol is an npm package used for generating protocol buffers. It provides tools and utilities for working with protocol buffers, including code generation and validation.
The vulnerability allows for the execution of arbitrary code, which can lead to unauthorized access, data breaches, and system compromise.
To fix this vulnerability, update the generate-protocol package to a non-malicious version, such as 5.2.1.
Yes, you can uninstall the affected version (6.0.2) and install a previous secure version (e.g., 5.2.1) of generate-protocol.
You can find more information about this vulnerability in the ReversingLabs report and the GitHub repository for the malicious-packages project.
