CVE-2022-5695: Malicious code in reactnativeflipperexample (npm)
Summary
MAL-2022-5695: Malicious code in reactnativeflipperexample (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The reactnativeflipperexample package is an npm package that provides an example project for React Native Flipper, a debugging tool for React Native applications. It is used to showcase the features and capabilities of Flipper. The package is part of the npm ecosystem and can be installed and used in React Native projects.
Vulnerability Detail
The reactnativeflipperexample package (npm) contains malicious code that compromises the security of any computer on which it is installed or running. This code gives full control of the computer to an outside entity, potentially exposing any secrets and keys stored on that computer. As a result, immediate action is required to mitigate the risk. Removing the package may not guarantee the removal of all malicious software installed as a result of its presence.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall reactnativeflipperexampleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, taking immediate action to rotate secrets and keys and removing the package can help mitigate the risk.
Conclusion
The reactnativeflipperexample package (npm) contains malicious code that compromises the security of the affected computer. Immediate action is required to rotate secrets and keys, remove the package, and conduct a thorough security audit. Additional security measures should be implemented to further protect the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for reactnativeflipperexample →
FAQ
Reactnativeflipperexample is an npm package that provides an example project for React Native Flipper, a debugging tool for React Native applications.
The malicious code in reactnativeflipperexample gives full control of the computer to an outside entity, potentially exposing any secrets and keys stored on that computer.
If you have reactnativeflipperexample installed, you should immediately rotate all secrets and keys stored on the affected computer from a different, secure computer. Then, remove the reactnativeflipperexample package and conduct a thorough security audit.
Removing the reactnativeflipperexample package may not guarantee the removal of all malicious software installed as a result of its presence. A thorough security audit is recommended to identify any potential compromises or unauthorized access.
In addition to removing the reactnativeflipperexample package, it is recommended to update passwords, enable two-factor authentication, and implement other security measures to further protect the affected system.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
