Malicious Package in require-ports: Critical Remote Code Execution Vulnerability
Summary
GHSA-qj3g-wfr7-3cv7: Malicious Package in require-ports. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The require-ports package is an npm package used for module installation. It allows users to easily install and manage modules in their Node.js projects. However, version 10.4.0 of require-ports contains a critical vulnerability. The package's preinstall script includes malicious code that, when installed, downloads and executes a file from a remote server, creating a backdoor on the affected computer. This vulnerability can lead to a complete compromise of the system, putting all stored secrets and keys at risk.
Vulnerability Detail
The vulnerability in require-ports version 10.4.0 arises from the inclusion of malicious code in its preinstall script. When users mistakenly install this version, the package downloads and executes a file from a remote server, granting full control of the computer to an external entity. As a result, all secrets and keys stored on the compromised computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software installed as a result of its installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to follow the recommended steps for fixing the issue and mitigating the potential damage caused by the compromised system.
Conclusion
The require-ports package version 10.4.0 contains a critical remote code execution vulnerability. This vulnerability can result in a complete compromise of the affected system, putting all stored secrets and keys at risk. It is crucial to identify and secure all computers with this package installed, rotate compromised secrets and keys, remove the package, and conduct a thorough security audit. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for require-ports →
FAQ
This vulnerability can lead to a complete compromise of the affected computer, allowing an external entity to gain full control. All secrets and keys stored on the compromised system should be rotated immediately.
Check if require-ports version 10.4.0 is installed on your computer. If it is, assume that your system is compromised and take appropriate actions to secure your secrets and keys.
Removing the require-ports package is recommended, but it may not guarantee the removal of all malicious software installed as a result of its installation. A thorough security audit is necessary to ensure the complete removal of any remaining malicious components.
If you have installed require-ports version 10.4.0, consider your computer fully compromised. Rotate all secrets and keys stored on the affected system from a different, secure computer. Remove the require-ports package and conduct a security audit to ensure the removal of any remaining malicious software.
There is no specific fix available for this vulnerability. Following the recommended steps for remediation and conducting a thorough security audit are essential to mitigate the potential damage caused by the compromised system.
References
Related vulnerabilities
Recent vulnerabilities recorded for require-ports.
