CVE-2023-476: Malicious code in gitlabhook (npm)
Summary
MAL-2023-476: Malicious code in gitlabhook (npm). Affects gitlabhook versions 1.999.0 – 9.999.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The gitlabhook package is an npm package used for integrating GitLab webhooks into Node.js applications. It allows developers to receive and process events triggered by GitLab repositories. The package is widely used in various projects and provides a convenient way to automate workflows and perform actions based on GitLab events.
Vulnerability Detail
The gitlabhook package has been identified as containing malicious code. Any computer that has this package installed or running should be considered fully compromised. The package communicates with a domain associated with malicious activity and executes commands that exhibit malicious behavior. As a result, all secrets and keys stored on the affected computer should be rotated immediately from a different computer. While removing the package is recommended, it may not guarantee the removal of all malicious software installed as a result of its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall gitlabhookIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is essential to follow the steps mentioned in the 'how_to_fix' section to address the issue effectively.
Conclusion
The gitlabhook package has been identified as containing malicious code, compromising the security of any computer with the package installed. It is crucial to rotate all secrets and keys stored on the affected computer and remove the package. However, additional steps may be necessary to ensure the complete removal of any malicious software. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gitlabhook →
FAQ
The gitlabhook package is an npm package used for integrating GitLab webhooks into Node.js applications. It allows developers to receive and process events triggered by GitLab repositories.
This vulnerability compromises the security of the affected computer. All secrets and keys stored on that computer should be rotated immediately from a different computer to prevent unauthorized access.
If you have the gitlabhook package installed, it is recommended to remove it from your computer immediately. Additionally, rotate all secrets and keys stored on the affected computer from a different, trusted computer.
While removing the gitlabhook package is recommended, there is no guarantee that it will remove all malicious software resulting from its installation. A thorough security audit is necessary to identify and mitigate any potential compromise.
After addressing this vulnerability, it is crucial to conduct a thorough security audit to identify any potential compromise. Additionally, follow security best practices, such as regularly updating software, using strong and unique passwords, and implementing multi-factor authentication.
References
Related vulnerabilities
Recent vulnerabilities recorded for gitlabhook.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
