Malicious Code in nodebs58 (npm)
Summary
MAL-2024-7885: Malicious code in nodebs58 (npm). Affects nodebs58 versions 2.3.2 – 2.5.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nodebs58 is an npm package that provides Base58 encoding and decoding functionality for Node.js applications. It is commonly used in cryptocurrency-related projects. However, the package has been found to contain a preinstall hook that executes unhook.js, which includes malicious code designed to steal cryptocurrencies.
Vulnerability Detail
The vulnerability in nodebs58 arises from the presence of the preinstall hook, which allows the execution of unauthorized code during the package installation process. This malicious code, found in unhook.js, is specifically designed to steal cryptocurrencies. If a user installs the affected version of nodebs58, their cryptocurrency assets may be at risk of being stolen. It is crucial to update to a secure version or find an alternative package to mitigate this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nodebs58If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a secure version or switch to a different package.
Conclusion
The presence of malicious code in the nodebs58 npm package poses a significant risk to applications that utilize it for Base58 encoding and decoding functionality. The vulnerability allows for the execution of unauthorized code during installation, which can result in the theft of cryptocurrencies. It is crucial to update to a secure version or switch to an alternative package to protect against this vulnerability.
See every vulnerability recorded for nodebs58 →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
If your application uses the affected version of nodebs58, there is a risk of cryptocurrency theft. The malicious code in unhook.js is specifically designed to exploit cryptocurrency-related functionality and steal assets from unsuspecting users.
There have been reports of this vulnerability being actively exploited in the wild. It is crucial to update to a secure version or switch to a different package to protect your application and its users.
Yes, the maintainers of nodebs58 have released a secure version that addresses this vulnerability. It is recommended to update to the latest secure version to mitigate the risk of cryptocurrency theft.
The package maintainers have been made aware of this vulnerability and have released a secure version to address it. However, it is always advisable to stay vigilant and regularly monitor the security of your dependencies to ensure timely updates and mitigate potential risks.
