Critical Vulnerability in leetlog Package
Summary
GHSA-gfm8-g3vm-53jh: Malicious Package in leetlog. Affects leetlog versions >= 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The leetlog package is an npm package used for logging purposes. It provides functionality to log messages and events in a specific format. The package is commonly used in Node.js applications to facilitate logging and debugging processes. However, versions 0.1.2 and 0.1.3 of leetlog have been found to contain malicious code that poses a significant security risk to systems where it is installed.
Vulnerability Detail
The vulnerability in leetlog versions 0.1.2 and 0.1.3 involves the inclusion of malicious code that adds an arbitrary hardcoded SSH key, identified as 'hacker@evilmachine', to the system's authorized_keys file. This unauthorized access allows an attacker to gain full control over the compromised system. As a result, any computer with this package installed or running should be considered fully compromised. Immediate action is required to mitigate the potential damage caused by this vulnerability. All secrets and keys stored on the affected computer should be rotated from a different, secure machine. It is crucial to note that simply removing the package may not remove all the malicious software installed as a result of its installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to follow the recommended steps to fix the issue and mitigate any potential damage.
Conclusion
The leetlog package versions 0.1.2 and 0.1.3 have been found to contain a critical vulnerability that allows unauthorized access to the system. It is crucial to take immediate action to mitigate the potential damage caused by this vulnerability. Rotate all secrets and keys, remove the package, and conduct a security audit to ensure no further compromises have occurred. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for leetlog →
FAQ
leetlog is an npm package used for logging purposes in Node.js applications.
Versions 0.1.2 and 0.1.3 of leetlog are affected by this vulnerability.
The impact of this vulnerability is severe as it allows an attacker to gain full control over the compromised system, potentially leading to unauthorized access and data breaches.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply provide your package-lock.json file for analysis.
If your system is affected, you should immediately disconnect it from any network or internet access, rotate all secrets and keys stored on the system, remove the leetlog package, and conduct a thorough security audit.
