Critical Vulnerability in nothing-js: Malicious Package
Summary
GHSA-353r-3v84-9pjj: Malicious Package in nothing-js. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nothing-js is an npm package that provides functionality for a specific task. It is vulnerable to a critical security issue that involves a malicious script embedded in the package. This script attempts to delete all files when the 'npm test' command is executed.
Vulnerability Detail
The vulnerability in nothing-js arises from the inclusion of a malicious script within the package. When the 'npm test' command is run, this script is triggered and attempts to delete all files on the system. This can lead to significant data loss and disruption of the affected environment. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the recommended steps for fixing the issue.
Conclusion
The critical vulnerability in nothing-js, caused by a malicious script embedded in the package, can lead to the deletion of all files on the system. It is crucial to take immediate action by removing the package from the environment to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nothing-js →
FAQ
The impact of this vulnerability can be severe, as it can result in the deletion of all files on the system when the 'npm test' command is executed.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using package-lock.json as a reference.
Yes, the recommended fix is to remove the nothing-js package from your environment. It has been unpublished from the npm Registry.
Yes, this vulnerability can be exploited remotely if an attacker is able to execute the 'npm test' command on the affected system.
The best mitigation for this vulnerability is to follow the recommended steps for fixing the issue, which involve removing the nothing-js package from the environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for nothing-js.
