Critical Vulnerability in only-test-not-install Package
Summary
GHSA-g9wf-393q-4w38: Malicious Package in only-test-not-install. Affects only-test-not-install versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The only-test-not-install package is an npm package used for testing purposes. It allows developers to run tests without actually installing the package. This package is commonly used in development environments to streamline the testing process. However, all versions of the only-test-not-install package contain a critical vulnerability that can lead to the deletion of the system's test folder during the postinstall script execution.
Vulnerability Detail
The vulnerability in the only-test-not-install package arises from malicious code present in all versions. When the package is installed, it executes a postinstall script that deletes the folder '~/test' from the system. This can have severe consequences as it may result in the loss of important test files and disrupt the testing process. The presence of this vulnerability poses a significant risk to the integrity and reliability of the development environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the package from the environment to mitigate the risk of data loss.
Conclusion
The only-test-not-install package contains a critical vulnerability that can lead to the deletion of the system's test folder. To mitigate this risk, it is recommended to remove the package from your environment. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for only-test-not-install →
FAQ
The only-test-not-install package is used for running tests without actually installing the package. It is commonly used in development environments to streamline the testing process.
The vulnerability in the only-test-not-install package can result in the deletion of the system's test folder. This can lead to the loss of important test files and disrupt the testing process in the development environment.
To fix this vulnerability, you should remove the only-test-not-install package from your environment by running the command 'npm uninstall only-test-not-install'.
No, there is no known workaround for this vulnerability. It is crucial to remove the package from the environment to mitigate the risk of data loss.
For more information about this vulnerability, you can refer to the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-g9wf-393q-4w38/GHSA-g9wf-393q-4w38.json
References
Related vulnerabilities
Recent vulnerabilities recorded for only-test-not-install.
