Malicious Code in pdf2htmlex2 (npm)
Summary
MAL-2023-8659: Malicious code in pdf2htmlex2 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pdf2htmlex2 is an npm package that provides a tool for converting PDF files to HTML. It is commonly used in various applications to extract content from PDF documents and make it accessible on the web. However, the package has been found to contain malicious code, which poses a significant security risk to any computer that has it installed or running.
Vulnerability Detail
The malicious code in pdf2htmlex2 has been identified as a serious threat. It is advised to consider any computer with this package installed or running as fully compromised. This means that all secrets and keys stored on the affected computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation, as the attacker may have gained full control of the compromised computer.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pdf2htmlex2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Unfortunately, there is no known workaround for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section to mitigate the risks.
Conclusion
The presence of malicious code in the pdf2htmlex2 package poses a significant security risk to any computer with it installed or running. It is crucial to take immediate action by removing the package and rotating all secrets and keys stored on the affected computer. For further support and information on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pdf2htmlex2 →
FAQ
pdf2htmlex2 is an npm package used for converting PDF files to HTML. It allows extracting content from PDF documents and making it accessible on the web.
The malicious code in pdf2htmlex2 compromises the security of your computer, potentially giving an outside entity full control. It is advised to rotate all secrets and keys stored on the affected computer.
Removing the package may not guarantee the removal of all malicious software resulting from its installation. It is crucial to rotate all secrets and keys stored on the compromised computer from a separate and secure machine.
Unfortunately, there is no known workaround for this vulnerability. Following the steps mentioned in the 'how_to_fix' section is the recommended course of action.
For further information and support on vulnerability remediation, you can reach out to info@devnack.com.
