CVE-2022-5773: Malicious code in reviewstack (npm)
Summary
MAL-2022-5773: Malicious code in reviewstack (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Reviewstack is an npm package used for code review and collaboration. It provides features for reviewing code changes, commenting, and suggesting improvements. The package is widely used in software development projects to facilitate code review processes. However, the reviewstack package is currently vulnerable to a malicious code injection.
Vulnerability Detail
The reviewstack package has been compromised with malicious code. This code can give full control of the affected computer to an external entity. As a result, any secrets and keys stored on the compromised computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software installed as a result of its installation. The presence of this package on a computer should be considered a complete compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall reviewstackIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to follow the steps mentioned in the 'how_to_fix' section to mitigate the risk and ensure the security of the affected system.
Conclusion
The reviewstack package has been compromised with malicious code, posing a significant security risk. It is crucial to take immediate action by rotating secrets and keys, removing the package, conducting a security audit, and installing a clean version from a trusted source. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for reviewstack →
FAQ
The impact of this vulnerability is severe as it can give full control of the affected computer to an external entity. All secrets and keys stored on the compromised computer should be rotated immediately to prevent unauthorized access.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using package-lock.json without requiring access to the code or installation.
No, removing the reviewstack package may not guarantee the removal of all malicious software installed as a result of its installation. A thorough security audit is recommended to identify and remove any potential malicious activities or software left behind.
If your system is affected, it is crucial to rotate all secrets and keys stored on the compromised computer from a different, trusted computer. Remove the reviewstack package, conduct a security audit, and install a clean and trusted version of the package.
Yes, there are several alternative packages available for code review and collaboration, such as GitLab, Bitbucket, and Phabricator. It is recommended to choose a package from a reliable source and regularly update it to ensure security.
