Malicious code in lc-config (npm)
Summary
MAL-2023-8629: Malicious code in lc-config (npm). Affects lc-config versions 5.5.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lc-config is an npm package that provides configuration options for a specific application. It is commonly used to manage various settings and parameters within the application. However, version 5.5.0 of lc-config has been identified as malicious by the OpenSSF Package Analysis project. This package is considered malicious because it communicates with a domain associated with malicious activity and executes commands linked to malicious behavior.
Vulnerability Detail
The vulnerability in lc-config version 5.5.0 arises from its malicious nature. The package establishes communication with a domain known for malicious activity, which can lead to unauthorized data exfiltration or other malicious actions. Additionally, it executes commands that can perform actions detrimental to the system or compromise its security. This vulnerability poses a significant risk to the integrity and security of the affected application.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lc-configIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to address the issue by removing or updating the lc-config package as mentioned in the 'how_to_fix' section.
Conclusion
lc-config version 5.5.0 has been identified as a malicious package that communicates with a domain associated with malicious activity and executes commands linked to malicious behavior. This vulnerability poses a significant risk to the security and integrity of the affected application. It is crucial to remove or update the lc-config package to a non-malicious version and thoroughly scan the application for signs of compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lc-config →
FAQ
lc-config is an npm package used for managing configuration options in an application.
lc-config version 5.5.0 is considered malicious as it communicates with a domain associated with malicious activity and executes commands linked to malicious behavior. This can lead to unauthorized data exfiltration or other malicious actions.
The potential consequences of this vulnerability include unauthorized data exfiltration, compromise of system security, and potential damage to the affected application.
To fix this vulnerability, it is recommended to remove or update the lc-config package to a non-malicious version. Thoroughly scan the application for signs of compromise and review other dependencies for any malicious code.
A non-malicious version of lc-config can be obtained from the official npm registry or other trusted sources.
