Malicious Package in rpc-websocket
Summary
GHSA-x87g-rgrh-r6g3: Malicious Package in rpc-websocket. Affects rpc-websocket versions >= 0.7.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rpc-websocket package is an npm package used for creating WebSocket servers and clients in Node.js applications. It provides a simple and efficient way to establish bidirectional communication between the server and the client. However, versions of rpc-websocket >= 0.7.6 were found to contain malicious code, which acts as a backdoor to a remote server and allows execution of arbitrary commands.
Vulnerability Detail
The vulnerability in rpc-websocket versions >= 0.7.6 allows an attacker to gain full control of the compromised computer. By installing the package, a backdoor is opened, enabling unauthorized access and execution of arbitrary commands. This can lead to the compromise of sensitive information, unauthorized actions, and potential damage to the system. It is crucial to take immediate action to mitigate the risk and prevent further exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to follow the recommended steps for fixing the issue and removing the malicious package.
Conclusion
The rpc-websocket package versions >= 0.7.6 contain a critical vulnerability that opens a backdoor to a remote server and allows execution of arbitrary commands. It is essential to identify and remove the affected package from all computers, rotate all compromised secrets and keys, and conduct a thorough security audit. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for rpc-websocket →
FAQ
The impact of this vulnerability is severe. It allows an attacker to gain full control of the compromised computer, potentially leading to unauthorized access, execution of arbitrary commands, and compromise of sensitive information.
If you have installed or are running rpc-websocket versions >= 0.7.6, your computer is likely affected. It is recommended to conduct a thorough security audit and follow the steps mentioned in the 'how_to_fix' section.
While removing the rpc-websocket package is necessary, it may not completely remove all malicious software or unauthorized access resulting from its installation. Conducting a security audit is crucial to ensure the system's integrity.
If you find evidence of unauthorized access or malicious software, it is recommended to isolate the affected computer from the network, conduct a thorough investigation, and take appropriate actions to remove the unauthorized access and mitigate any potential damage.
To prevent similar vulnerabilities, it is crucial to regularly update and patch all software components, including third-party packages. Additionally, conducting security audits, implementing secure coding practices, and staying informed about the latest security advisories can help mitigate risks.
