Malicious Package in pizza-pasta
Summary
GHSA-wxrm-2h86-v95f: Malicious Package in pizza-pasta. Affects pizza-pasta versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pizza-pasta package is an npm package that provides functionality related to pizza and pasta recipes. It is commonly used by developers to access a collection of recipes, ingredients, and cooking instructions for various pizza and pasta dishes. Unfortunately, version 1.0.3 of this package contains a malicious code in its install scripts, which poses a significant security risk to users.
Vulnerability Detail
The vulnerability in version 1.0.3 of pizza-pasta is due to the presence of malicious code in its install scripts. When the package is installed, it creates folders on the user's Desktop and downloads an image from imgur.com. Additionally, it prints the user's SSH keys to the console, potentially exposing sensitive information. This malicious behavior can lead to unauthorized access, data breaches, and compromise of the user's system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
Version 1.0.3 of the pizza-pasta package contains a critical vulnerability that allows for unauthorized access and potential compromise of the user's system. It is crucial to remove this package from your environment to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pizza-pasta →
FAQ
The impact of this vulnerability can be severe, as it allows an attacker to gain unauthorized access to the user's system, potentially leading to data breaches and compromise of sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the package-lock.json file.
Yes, the fix for this vulnerability is to remove the pizza-pasta package from your environment. Make sure to update to a non-affected version or find an alternative package for your pizza and pasta recipe needs.
There are no known workarounds for this vulnerability. It is recommended to remove the package to mitigate the risk.
For more information about this vulnerability, you can refer to the GitHub Security Advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-wxrm-2h86-v95f/GHSA-wxrm-2h86-v95f.json
References
Related vulnerabilities
Recent vulnerabilities recorded for pizza-pasta.
