Malicious Code in odn-static-assets (npm)
Summary
MAL-2023-8461: Malicious code in odn-static-assets (npm). Affects odn-static-assets versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
odn-static-assets is an npm package that provides static assets for a web application. It is commonly used to serve images, stylesheets, and other static files. This package is vulnerable to a malicious code injection attack, which can compromise the security of the host computer and expose any secrets or keys stored on it.
Vulnerability Detail
The vulnerability originates from the presence of malicious code in the odn-static-assets package. This code can give full control of the affected computer to an external entity, making it fully compromised. As a result, all secrets and keys stored on the computer should be rotated immediately from a different computer. Simply removing the package may not guarantee the removal of all malicious software installed as a result of its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall odn-static-assetsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, taking immediate action to rotate secrets and keys and removing the odn-static-assets package can help mitigate the risk.
Conclusion
The presence of malicious code in the odn-static-assets npm package poses a significant security risk. It is crucial to take immediate action by rotating secrets and keys, removing the package, and performing a thorough security scan and cleanup. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for odn-static-assets →
FAQ
odn-static-assets is an npm package used to serve static assets for web applications, such as images and stylesheets.
The malicious code in odn-static-assets can give full control of the affected computer to an external entity, compromising its security and exposing any stored secrets or keys.
If you have odn-static-assets installed, it is recommended to rotate all secrets and keys stored on the affected computer from a different, secure computer. Remove the odn-static-assets package and perform a thorough security scan and cleanup.
There is no guarantee that removing the odn-static-assets package will remove all malicious software installed as a result of its installation. It is important to perform a thorough security scan and cleanup of the affected computer.
After removing the odn-static-assets package, it is recommended to perform a thorough security scan and cleanup of the affected computer to ensure the removal of any remaining malicious software.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
