Critical Vulnerability in malicious-do-not-install Package
Summary
GHSA-6879-xr95-5gf4: Malicious Package in malicious-do-not-install. Affects malicious-do-not-install versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The malicious-do-not-install package is an npm package that is designed to contain malicious code. It is used to copy sensitive files, such as /etc/passwd and /etc/shadow, to the local /tmp/ folder. This package poses a significant security risk to any environment it is installed in.
Vulnerability Detail
The malicious-do-not-install package contains code that copies sensitive files from the host system to the local /tmp/ folder. This can result in the exposure of sensitive information, such as user credentials. The package has a critical severity rating with a CVSS score of 9.8. It is important to remove this package from your environment and rotate any affected credentials to mitigate the risk of unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The malicious-do-not-install package contains malicious code that can lead to the exposure of sensitive information. It is critical to remove this package from your environment and rotate any affected credentials to mitigate the risk of unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for malicious-do-not-install →
FAQ
This vulnerability can lead to the exposure of sensitive information, such as user credentials, which can be used for unauthorized access.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will provide real-time alerts for any open-source vulnerabilities.
This vulnerability has a critical severity rating with a CVSS score of 9.8.
To remove the malicious-do-not-install package, use the appropriate package manager command for your ecosystem. For example, if you are using npm, run npm uninstall malicious-do-not-install.
If your credentials are affected, it is recommended to rotate them immediately. This involves generating new passwords or API keys and updating them in your application and any associated systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for malicious-do-not-install.
