Malicious Package in momen - Remote Code Execution
Summary
GHSA-h5vm-jhq7-w647: Malicious Package in momen. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The momen package is an open-source npm package used for handling dates and times in JavaScript applications. It provides various functionalities for parsing, manipulating, and formatting dates. The package is widely used in Node.js projects and has a large user base. Unfortunately, all versions of momen were found to contain a malicious package that was typosquatted, leading to potential security risks for users who installed the incorrect package.
Vulnerability Detail
The malicious package uploaded sensitive information to a remote server, including the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running with sudo privileges. This information could be used by attackers to track users and potentially exploit their systems. The vulnerability has a CVSS score of 9.8, indicating a critical severity level. It is crucial to remove the affected package from dependencies and ensure that package names are typed correctly during installation to mitigate the risk of this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The momen package contained a malicious package that tracked users who installed it incorrectly. This vulnerability allowed attackers to gather sensitive information about users' systems. To mitigate the risk, it is crucial to remove the affected package, ensure correct package names during installation, and follow best practices for package management and security. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for momen →
FAQ
The vulnerability allows attackers to track users who have installed the malicious package and gather sensitive information about their systems. This information could potentially be used for further attacks or exploitation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
No specific workaround is available for this vulnerability. The best course of action is to remove the affected package and ensure correct package names during installation.
Yes, all versions of momen are affected by this vulnerability. It is recommended to remove the package from your dependencies regardless of the version.
If you have installed the malicious package, it is important to remove it immediately from your project's dependencies. You should also review your system for any potential security breaches and consider taking necessary actions to secure your environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for momen.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
