Malicious Package in hpmm - Critical Vulnerability
Summary
GHSA-vxfp-qmpq-6826: Malicious Package in hpmm. Affects hpmm versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hpmm package is an npm package that is used for system monitoring. It provides functionality to collect and upload system information to a remote server. The package is commonly used in various applications for monitoring and analyzing system metrics. However, all versions of hpmm have been found to contain malicious code that compromises the security of the system.
Vulnerability Detail
The malicious code present in the hpmm package uploads system information to a remote server and downloads and executes a file. This unauthorized activity gives full control of the compromised computer to an external entity. As a result, any secrets and keys stored on the affected computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software installed as a result of its installation. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The hpmm package has been found to contain malicious code that compromises the security of the system. If you have this package installed, it is crucial to take immediate action to rotate all secrets and keys stored on the affected system from a different computer and remove the package. However, removing the package may not guarantee the removal of all malicious software. A thorough security audit is recommended to ensure the system's integrity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hpmm →
FAQ
The hpmm package is an npm package used for system monitoring and collecting system information.
The malicious code uploads system information to a remote server, downloads a file, and executes it, giving full control of the compromised computer to an external entity.
If you have the hpmm package installed, you should consider your system fully compromised. Rotate all secrets and keys stored on the affected system from a different computer and remove the hpmm package.
Removing the hpmm package may not guarantee the removal of all malicious software installed as a result of its installation. A thorough security audit is recommended to identify any potential malicious activities or software left behind.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for hpmm.
