Malicious Package in shrugging-logging
Summary
GHSA-qv78-398w-cxp7: Malicious Package in shrugging-logging. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shrugging-logging package is an npm package used for logging purposes. It is designed to provide logging functionality to applications developed using the npm ecosystem. The package allows developers to log various events and messages during the execution of their applications. Unfortunately, all versions of shrugging-logging contain a malicious code as a postinstall script.
Vulnerability Detail
The vulnerability in shrugging-logging is due to the presence of malicious code in the postinstall script. When the package is installed, it fetches all names of npm packages owned by the user and attempts to add another maintainer to every package. This behavior is a form of package hijacking, where an unauthorized maintainer is added to npm packages without the owner's consent. The malicious code poses a significant security risk as it can lead to unauthorized access, data breaches, and potential misuse of the compromised packages.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The shrugging-logging package contains a critical vulnerability due to the presence of malicious code in its postinstall script. To mitigate the risk, it is essential to remove the package from your system, contact npm security if any packages were compromised, and enable two-factor authentication (2FA) for publishing packages. For additional support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for shrugging-logging →
FAQ
shrugging-logging is an npm package used for logging purposes in applications developed using the npm ecosystem.
The malicious code in shrugging-logging attempts to add another maintainer to every npm package owned by the user, leading to package hijacking and potential unauthorized access to the compromised packages.
To fix the vulnerability, you should remove the shrugging-logging package from your system and contact npm security if any of your packages were compromised. Enabling two-factor authentication (2FA) for publishing packages is also recommended.
The vulnerability can result in unauthorized access, data breaches, and misuse of compromised npm packages.
For further support on vulnerability remediation, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for shrugging-logging.
