Malicious Package in node-spdy
Summary
GHSA-wfjh-3hq2-r276: Malicious Package in node-spdy. Affects node-spdy versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-spdy is an npm package that provides SPDY server and client implementations for Node.js. It allows for faster and more efficient data transmission over the web. However, a vulnerability has been discovered in this package that involves the presence of malicious code.
Vulnerability Detail
The node-spdy package contained malicious code that uploaded system information, such as the operating system and hostname, to a remote server. This unauthorized data collection poses a significant security risk as it compromises the privacy and integrity of the affected systems. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to remove the node-spdy package from your environment. By removing the package, you eliminate the risk of further compromise and prevent any unauthorized data collection.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The node-spdy package has been found to contain malicious code that uploads system information to a remote server. To mitigate this vulnerability, it is crucial to remove the package from your environment. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-spdy →
FAQ
Node-spdy is an npm package that provides SPDY server and client implementations for Node.js. It enables faster and more efficient data transmission over the web.
The malicious code in node-spdy uploads system information, such as the operating system and hostname, to a remote server without authorization. This compromises the privacy and integrity of the affected systems.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8, indicating a high level of risk and potential impact.
To fix this vulnerability, you should remove the node-spdy package from your environment. This eliminates the risk of further compromise and prevents unauthorized data collection.
There are no indications of further compromise beyond the malicious code present in the node-spdy package.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-spdy.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.