Malicious code in loadyaml package
Summary
GHSA-mfc2-93pr-jf92: Malicious code in loadyaml. Affects loadyaml versions < 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The loadyaml package is an npm package that allows users to load YAML files in their Node.js applications. It provides a simple and convenient way to parse and access data from YAML files. However, a recent vulnerability has been discovered in the loadyaml package, which allows malicious code execution upon installation.
Vulnerability Detail
The loadyaml package was found to contain malicious code that runs a preinstall script upon installation. This script writes a public comment on GitHub, leaking sensitive information such as IP and IP-based geolocation, home directory name, and local username. The malicious packages, loadyaml and electorn, have been removed from the npm registry, and the leaked content has been removed from GitHub. This vulnerability poses a significant risk to users' privacy and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section and avoid using the loadyaml package.
Conclusion
The loadyaml package has been found to contain malicious code that leaks sensitive information upon installation. It is crucial to avoid using this package and any versions prior to 1.0.2. Instead, opt for alternative packages and regularly update your dependencies to ensure you are using the latest secure versions. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for loadyaml →
FAQ
The loadyaml package is an npm package that allows users to load YAML files in their Node.js applications. It provides a convenient way to parse and access data from YAML files.
This vulnerability allows malicious code execution upon installation of the loadyaml package. It leaks sensitive information such as IP and IP-based geolocation, home directory name, and local username.
Yes, the malicious packages, loadyaml and electorn, have been removed from the npm registry. The leaked content from the preinstall script has also been removed from GitHub.
To fix this vulnerability, it is recommended to avoid using the loadyaml package and any versions prior to 1.0.2. Instead, consider using alternative packages that provide similar functionality and have not been affected by this vulnerability. Regularly updating your packages is also important.
There is no specific workaround provided for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section and avoid using the loadyaml package.
References
Related vulnerabilities
Recent vulnerabilities recorded for loadyaml.
