Malicious code in node-common-npm-scripts (npm)
Summary
MAL-2023-8537: Malicious code in node-common-npm-scripts (npm). Affects node-common-npm-scripts versions 4.11.1 – 6.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-common-npm-scripts package is an npm package that provides common scripts for Node.js projects. It is commonly used to automate various tasks such as building, testing, and deploying Node.js applications. This package is vulnerable to a malicious code injection.
Vulnerability Detail
The node-common-npm-scripts package at version 6.3.0 has been identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity. This can lead to various security risks, including unauthorized access, data breaches, and the execution of arbitrary code on the affected system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-common-npm-scriptsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to a non-malicious version as soon as possible.
Conclusion
The node-common-npm-scripts package at version 6.3.0 has been identified as malicious. It is crucial to update the package to a non-malicious version to mitigate the security risks associated with this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-common-npm-scripts →
FAQ
Node-common-npm-scripts is an npm package that provides common scripts for Node.js projects. It helps automate various tasks such as building, testing, and deploying Node.js applications.
The malicious code in the node-common-npm-scripts package can lead to unauthorized access, data breaches, and the execution of arbitrary code on the affected system. It poses a significant security risk to your application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, there is a fix available for this vulnerability. You need to update the node-common-npm-scripts package to a non-malicious version. Refer to the 'how_to_fix' section for detailed instructions.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in fixing this vulnerability.
