CVE-2022-5653: Malicious code in react-ldclient-default-values (npm)
Summary
MAL-2022-5653: Malicious code in react-ldclient-default-values (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The react-ldclient-default-values package is an npm package used in React applications. It provides default values for LaunchDarkly client-side feature flags. This package is vulnerable to a malicious code injection attack.
Vulnerability Detail
The react-ldclient-default-values package has been found to contain malicious code. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-ldclient-default-valuesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
Conclusion
The react-ldclient-default-values package has been found to contain malicious code, posing a severe security risk to any system running it. It is crucial to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for react-ldclient-default-values →
FAQ
The impact of this vulnerability is severe. Any system running the react-ldclient-default-values package is fully compromised, and all secrets and keys stored on that system should be rotated immediately.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the react-ldclient-default-values package is present.
While removing the react-ldclient-default-values package is recommended, there is no guarantee that it will remove all malicious software resulting from installing it. It is crucial to rotate all secrets and keys stored on the affected system from a different computer.
No, there is no patch available for this vulnerability. The only way to mitigate the risk is to follow the steps mentioned in the 'how_to_fix' section.
To prevent this vulnerability in the future, it is essential to regularly update and audit the packages used in your application. Additionally, consider using a vulnerability monitoring tool like Vulert (https://vulert.com) to receive real-time alerts for open-source vulnerabilities.
