CVE-2023-632: Malicious code in node-http-uatraits (npm)
Summary
MAL-2023-632: Malicious code in node-http-uatraits (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The node-http-uatraits package is an npm package that provides traits for HTTP user agents. It is used to enhance the functionality of HTTP clients in Node.js applications. This package is vulnerable to a malicious code injection attack, which compromises the security of any computer that has the package installed or running.
Vulnerability Detail
The vulnerability originates from a specific version of the node-http-uatraits package (0.0.1). This version contains malicious code that can fully compromise a computer, giving control to an outside entity. As a result, all secrets and keys stored on the affected computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software installed as a result of its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-http-uatraitsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to remove the affected package and follow the recommended steps to mitigate the risk.
Conclusion
The node-http-uatraits package (version 0.0.1) is vulnerable to a malicious code injection attack. It is crucial to remove the affected package, rotate all secrets and keys stored on the affected computer, and update dependencies to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-http-uatraits →
FAQ
The impact of this vulnerability is severe as it compromises the security of the affected computer and gives control to an outside entity. All secrets and keys stored on the compromised computer should be rotated immediately to prevent unauthorized access.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and it will alert you in real-time if any open-source vulnerabilities, including this one, are found.
While removing the affected package is recommended, it may not guarantee the removal of all malicious software that may have been installed as a result of its installation. It is important to rotate all secrets and keys stored on the affected computer to ensure their security.
If your application is affected, you should immediately remove the node-http-uatraits package, rotate all secrets and keys stored on the affected computer, and update your dependencies to prevent similar vulnerabilities in the future.
To prevent similar vulnerabilities in the future, it is important to regularly update your dependencies, keep track of security advisories, and follow best practices for secure coding and package management.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
