Malicious Package in node-ftp
Summary
GHSA-5jgp-pg4f-q8vj: Malicious Package in node-ftp. Affects node-ftp versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-ftp package is an npm package that provides FTP client functionality for Node.js applications. It allows developers to interact with FTP servers, perform file transfers, and manage directories. The package is widely used in various projects and provides a convenient way to integrate FTP functionality into Node.js applications.
Vulnerability Detail
The node-ftp package was found to contain malicious code. When the package is installed and used, it uploads system information such as the operating system and hostname to a remote server. This unauthorized data collection can lead to privacy breaches and potential misuse of sensitive information. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The node-ftp package has been found to contain malicious code that uploads system information to a remote server. To mitigate the risk, it is crucial to remove the package from your environment and consider using alternative FTP client libraries. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for node-ftp →
FAQ
The vulnerability allows an attacker to collect system information from the affected Node.js application, potentially leading to privacy breaches and misuse of sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the recommended fix is to remove the node-ftp package from your environment. This will eliminate the risk of further compromise and prevent the unauthorized collection of system information.
Yes, there are alternative FTP client libraries available for Node.js that are actively maintained and have a good security track record. It is advisable to review and choose a package that meets your requirements and has a strong focus on security.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-5jgp-pg4f-q8vj/GHSA-5jgp-pg4f-q8vj.json
References
Related vulnerabilities
Recent vulnerabilities recorded for node-ftp.
