Malicious Package in react-server-native
Summary
GHSA-fwvp-x5gj-773j: Malicious Package in react-server-native. Affects react-server-native versions 0.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The react-server-native package is an npm package used for server-side rendering of React components. It allows developers to render React components on the server and send the rendered HTML to the client. This package is commonly used in web applications built with React. However, version 0.0.7 of this package contained malicious code that could compromise user data.
Vulnerability Detail
The vulnerability in version 0.0.7 of react-server-native is due to the presence of malicious code. When executed in the browser, the code would extract sensitive information such as passwords, cvc, and card numbers from form fields. The extracted values were then sent to a remote server at https://js-metrics.com/minjs.php?pl=. This could lead to unauthorized access to user data and potential misuse of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the package to a non-vulnerable version.
Conclusion
The react-server-native package version 0.0.7 contained malicious code that could compromise user data. It is crucial to update to a non-vulnerable version and evaluate the application for any potential data compromise. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for react-server-native →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
The potential consequences of this vulnerability include unauthorized access to user data, potential misuse of sensitive information such as passwords and card numbers, and potential compromise of user accounts.
Yes, downgrading to version 0.0.6 of react-server-native is a valid mitigation strategy. However, it is recommended to update to a non-vulnerable version if possible.
The advisory does not provide specific information about data compromise. It is recommended to evaluate your application and investigate any potential unauthorized access or misuse of user data.
There may be alternative packages available for server-side rendering of React components. It is recommended to research and evaluate other packages based on your specific requirements and the security track record of the package.
