Malicious code in mobile-auth-library-react-native (npm)
Summary
MAL-2024-2667: Malicious code in mobile-auth-library-react-native (npm). Affects mobile-auth-library-react-native versions 0.9.0 – 1.3.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mobile-auth-library-react-native package is an npm package that provides authentication functionality for mobile applications developed using React Native. It is commonly used to implement user authentication and authorization features in mobile apps. However, this package has been found to contain malicious code, which poses a significant security risk to applications that depend on it.
Vulnerability Detail
The vulnerability in mobile-auth-library-react-native is due to the presence of malicious code within the package. This code can potentially compromise the security of the mobile application by allowing unauthorized access, leaking sensitive user information, or performing other malicious activities. The malicious code was identified and reported by ReversingLabs, a security research firm. The affected versions of the package include 1.3.9, 0.9.1, 1.3.8, and 0.9.0.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall mobile-auth-library-react-nativeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can consider removing the mobile-auth-library-react-native package from their applications and replacing it with a trusted alternative that provides similar functionality. This will help mitigate the risk of the malicious code being executed within the application.
Conclusion
The presence of malicious code in the mobile-auth-library-react-native package poses a significant security risk to applications that depend on it. It is crucial for developers to update to a secure version of the package as soon as possible and review their code for any other potential security issues. Regularly checking for updates and staying informed about vulnerabilities is essential to maintain the security of your application.
See every vulnerability recorded for mobile-auth-library-react-native →
FAQ
The malicious code can potentially compromise the security of your application by allowing unauthorized access, leaking sensitive user information, or performing other malicious activities. It is important to update the package to a secure version as soon as possible.
No, only versions 1.3.9, 0.9.1, 1.3.8, and 0.9.0 are known to be affected. It is recommended to check the package's release notes or consult the package maintainers for a list of secure versions.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
If your application is affected, you should immediately update the mobile-auth-library-react-native package to a secure version. Additionally, you should review your application's code and dependencies for any other potential security issues.
Yes, as a temporary workaround, you can consider removing the mobile-auth-library-react-native package from your application and replacing it with a trusted alternative that provides similar functionality.
