Malicious Package in ripmed160
Summary
GHSA-gmjp-776j-2394: Malicious Package in ripmed160. Affects ripmed160 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ripmed160 package is an npm package used for cryptographic hashing. It provides a function to compute the RIPEMD-160 hash of a given input. The package is commonly used in applications that require secure hashing of data, such as password storage or digital signatures. However, all versions of this package were found to contain malware, which was designed to find and exfiltrate cryptocurrency wallets.
Vulnerability Detail
The vulnerability in ripmed160 arises from the presence of malware in all versions of the package. This malware is capable of compromising the security of any computer that has the package installed or running. Once installed, the malware can give full control of the computer to an outside entity, potentially leading to the theft of cryptocurrency wallets and other sensitive information. It is crucial to consider any computer with this package as fully compromised, and all secrets and keys stored on that computer should be rotated immediately from a different computer.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The ripmed160 package has been found to contain malware that can compromise the security of computers where it is installed or running. It is crucial to consider any computer with this package as fully compromised and take immediate steps to rotate all secrets and keys stored on those computers. Removing the package alone may not be sufficient to remove all malicious software. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ripmed160 →
FAQ
ripmed160 is an npm package used for cryptographic hashing. It provides a function to compute the RIPEMD-160 hash of a given input.
The malicious package in ripmed160 is designed to find and exfiltrate cryptocurrency wallets. It can compromise the security of any computer that has the package installed or running, potentially leading to the theft of cryptocurrency wallets and other sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities in the software.
If your computer is affected by this vulnerability, you should consider it as fully compromised. Rotate all secrets and keys stored on the compromised computer from a different, secure computer. Remove the ripmed160 package from the compromised computer. It is recommended to seek further support on vulnerability remediation from info@devnack.com.
Removing the ripmed160 package may not guarantee the removal of all malicious software resulting from its installation. Therefore, it is crucial to rotate all secrets and keys stored on the compromised computer and follow the recommended steps mentioned earlier to ensure the security of the compromised systems.
