Malicious Package in require-port - Critical Vulnerability
Summary
GHSA-rrvm-gqq8-q2wx: Malicious Package in require-port. Affects require-port versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The require-port package is an npm package used for module installation. It provides a convenient way for users to install modules by typing their names. However, version 1.0.0 of this package contains a malicious code as a preinstall script. This malware is designed to exploit users who make a typing mistake when installing a module. Once installed, the package downloads a file from a remote server, executes it, and opens a backdoor on the compromised computer.
Vulnerability Detail
The vulnerability in require-port version 1.0.0 allows an attacker to gain full control of the compromised computer. By executing the malicious code, the attacker can download and execute additional files, potentially stealing sensitive information or performing unauthorized actions. Any computer with this package installed or running should be considered fully compromised. It is crucial to rotate all secrets and keys stored on the affected computer from a different, secure machine.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to address the issue.
Conclusion
The 'require-port' package version 1.0.0 contains a critical vulnerability that allows an attacker to gain full control of the compromised computer. It is recommended to remove the package and consider the affected computer as compromised. Rotate all secrets and keys stored on that computer from a different, secure machine. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for require-port →
FAQ
The impact of this vulnerability is severe as it allows an attacker to gain full control of the compromised computer, potentially leading to unauthorized access, data theft, and other malicious activities.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
If your computer is affected, it is crucial to rotate all secrets and keys stored on that computer from a different, secure machine. Additionally, follow the steps mentioned in the 'how_to_fix' section to address the vulnerability.
This vulnerability specifically affects version 1.0.0 of the 'require-port' package. It is recommended to avoid using this version and consider using a more recent, secure version of the package.
Since the attacker may have gained full control of the compromised computer, there is no guarantee that removing the 'require-port' package will remove all the malicious software resulting from its installation. It is recommended to take appropriate actions to secure the affected computer.
References
Related vulnerabilities
Recent vulnerabilities recorded for require-port.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
