CVE-2022-5745: Malicious code in remote-pay-cloud-starter-example (npm)
Summary
MAL-2022-5745: Malicious code in remote-pay-cloud-starter-example (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The remote-pay-cloud-starter-example package is an npm package that provides a starter example for integrating with a remote payment cloud service. It is commonly used in applications that require payment processing functionality. This package is vulnerable to a malicious code injection attack, which can compromise the security of the host system and expose any secrets and keys stored on that computer.
Vulnerability Detail
The vulnerability originates from the presence of malicious code in the remote-pay-cloud-starter-example package. Any computer that has this package installed or running should be considered fully compromised. The attacker gains full control of the computer, and there is no guarantee that removing the package will remove all malicious software resulting from its installation. As a result, all secrets and keys stored on the compromised computer should be rotated immediately from a different computer to prevent further unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall remote-pay-cloud-starter-exampleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to remove the remote-pay-cloud-starter-example package and follow the recommended steps to mitigate the impact of the attack.
Conclusion
The presence of malicious code in the remote-pay-cloud-starter-example package poses a significant security risk to any system running it. It is crucial to identify and remove the package from all affected systems, rotate all secrets and keys, and conduct a thorough security audit. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for remote-pay-cloud-starter-example →
FAQ
The impact of this vulnerability is severe, as it allows an attacker to gain full control of the compromised system and access any stored secrets and keys. It is crucial to take immediate action to prevent further unauthorized access.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes the package-lock.json file and provides real-time alerts for open-source vulnerabilities.
While removing the remote-pay-cloud-starter-example package is a necessary step, it may not completely remove all malicious software installed as a result of the attack. It is recommended to rotate all secrets and keys stored on the compromised system and conduct a thorough security audit.
At present, there are no known mitigations for this vulnerability. The best course of action is to remove the package, rotate all secrets and keys, and conduct a security audit to ensure no other malicious software or backdoors are present.
For more information about this vulnerability, you can refer to the GitHub repository of malicious packages maintained by the Open Source Security Foundation (OSSF).
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
