Malicious Package in koa-body-parse
Summary
GHSA-wqgq-mfvj-6qxp: Malicious Package in koa-body-parse. Affects koa-body-parse versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The koa-body-parse package is an npm package used in the Node.js ecosystem. It is designed to parse the request body in Koa applications. This package is widely used by developers to handle HTTP requests and extract data from the request body. However, a vulnerability has been discovered in this package that allows for the execution of malicious code.
Vulnerability Detail
The koa-body-parse package contained malicious code that uploaded system information, such as the operating system and hostname, to a remote server. This unauthorized data collection poses a significant security risk as it can lead to the exposure of sensitive information and potential compromise of the system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to remove the package and follow the recommended steps for remediation.
Conclusion
The koa-body-parse package has been found to contain malicious code that uploads system information to a remote server. To protect your system and data, it is recommended to remove the package from your environment and review your project's dependencies. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for koa-body-parse →
FAQ
The impact of this vulnerability is the potential exposure of system information to a remote server, which can lead to further compromise and unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes the package-lock.json file to identify and alert in real-time for open-source vulnerabilities.
Yes, the recommended fix is to remove the koa-body-parse package from your environment and review the dependencies of your project to ensure they are from trusted sources.
There are no indications of further compromise mentioned in the vulnerability details. However, it is crucial to take immediate action and remove the package to mitigate any potential risks.
This vulnerability has a CVSS score of 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for koa-body-parse.
