CVE-2022-3630: Malicious code in hide990 (npm)
Summary
MAL-2022-3630: Malicious code in hide990 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
hide990 is an npm package that provides functionality for hiding sensitive information in a computer system. It is commonly used in applications that require secure storage and retrieval of secrets and keys. However, the hide990 package is currently vulnerable to a malicious code injection.
Vulnerability Detail
The hide990 package has been compromised by a malicious code injection. This vulnerability allows an attacker to gain full control of any computer that has the package installed or running. As a result, all secrets and keys stored on the compromised computer are at risk. It is crucial to rotate these secrets and keys immediately from a different computer. Removing the hide990 package may not guarantee the removal of all malicious software installed as a result of the compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hide990If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to follow the recommended steps for fixing the issue.
Conclusion
The hide990 package has been compromised by a malicious code injection, posing a significant risk to the security of systems using this package. It is crucial to remove the package, rotate all secrets and keys, and conduct a security audit to ensure the integrity of the affected computer. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hide990 →
FAQ
The impact of this vulnerability is severe as it allows an attacker to gain full control of the compromised computer and access sensitive information, including secrets and keys.
If you have the hide990 package installed or running on your computer, it is highly likely that your system is compromised. It is recommended to remove the package and rotate all secrets and keys stored on the computer.
No, updating the hide990 package will not fix the vulnerability. The package itself has been compromised, and removing it is the recommended course of action.
If you suspect that your secrets and keys have been compromised, it is crucial to rotate them immediately from a different, secure computer. This will help mitigate the risk of unauthorized access to your sensitive information.
There is no guarantee that removing the hide990 package will remove all malicious software resulting from the compromise. It is advisable to conduct a thorough security audit to identify and remove any other potential compromises.
