Malicious Package in js-regular
Summary
GHSA-qcc9-q247-3m2m: Malicious Package in js-regular. Affects js-regular versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-regular package is an npm package used for regular expression operations in JavaScript. It provides functions and utilities to work with regular expressions. However, the package has been found to contain malicious code that uploads system information to a remote server.
Vulnerability Detail
The vulnerability in js-regular arises from the presence of malicious code within the package. When the package is used, it secretly collects system information such as the operating system and hostname and sends it to a remote server. This unauthorized data collection can lead to privacy breaches and potential misuse of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The js-regular package has been found to contain malicious code that uploads system information to a remote server. To protect your system and prevent potential privacy breaches, it is recommended to remove the package from your environment. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for js-regular →
FAQ
js-regular is an npm package used for regular expression operations in JavaScript. It provides functions and utilities to work with regular expressions.
The vulnerability in js-regular allows the package to collect system information and send it to a remote server without authorization. This can lead to privacy breaches and potential misuse of sensitive information.
To fix the vulnerability, you should remove the js-regular package from your environment. This can be done by uninstalling the package using the package manager or by removing the package reference from your project's dependencies.
No specific workarounds have been mentioned for this vulnerability. The recommended solution is to remove the js-regular package from your environment.
You can find more information about this vulnerability in the GitHub Advisory Database. The provided link in the vulnerability details section can be used to access the specific advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-regular.
