Malicious Package in rate-map
Summary
GHSA-x48m-gp6r-gp4v: Malicious Package in rate-map. Affects rate-map versions >= 1.0.3, < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rate-map package is an npm package used for rate mapping. It provides functionality for mapping rates in PureScript. The package is vulnerable to a malicious code injection in version 1.0.3, which affects the purescript-installer package by modifying the code of the dl-tar dependency.
Vulnerability Detail
The vulnerability in version 1.0.3 of rate-map involves the presence of malicious code. This code compromises the functionality of the purescript-installer package by altering the code of the dl-tar dependency. The exact origin of the malicious code is not specified. The impact of this vulnerability can be severe, potentially leading to unauthorized access, data breaches, or other malicious activities. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-506.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
npm install rate-map@1.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The rate-map package version 1.0.3 contains a malicious code vulnerability that compromises the purescript-installer package. To ensure the security of your application, it is crucial to upgrade to version 1.0.5 or any later version of the rate-map package. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rate-map →
FAQ
The impact of this vulnerability can be severe, potentially leading to unauthorized access, data breaches, or other malicious activities.
To mitigate the risk, it is recommended to upgrade to version 1.0.5 or any later version of the rate-map package.
No workaround is mentioned for this vulnerability. It is recommended to upgrade to a secure version of the package.
The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-506.
You can find more information about this vulnerability in the GitHub Advisory Database. Please refer to the provided source link for detailed information.
