Malicious Package in stream-combine
Summary
GHSA-w6xj-45gv-fw35: Malicious Package in stream-combine. Affects stream-combine versions 2.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stream-combine package is an npm package used for combining multiple streams into a single stream. It provides a convenient way to handle data flow in applications that involve streaming data. However, version 2.0.2 of this package has been found to contain malicious code designed to steal credentials and credit card information. The code searches for sensitive information in form elements and uploads it to a remote server.
Vulnerability Detail
The vulnerability in version 2.0.2 of stream-combine allows an attacker to steal credentials and credit card information from applications that use this package. The malicious code scans form elements for passwords, credit card numbers, and CVC codes, and then sends the collected information to a remote server. Applications that have Content Security Policy set are not affected by this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The stream-combine package version 2.0.2 has been found to contain malicious code that can steal sensitive information. It is important to downgrade to version 2.0.1 and take necessary precautions to protect any potentially compromised data. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for stream-combine →
FAQ
The malicious code searches for passwords, credit card numbers, and CVC codes in form elements of applications that use the stream-combine package. It then uploads the collected information to a remote server.
No, applications that have Content Security Policy set are not affected by this vulnerability.
It is recommended to downgrade to version 2.0.1 of the stream-combine package to avoid the vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file to the playground.
If your application is affected, it is recommended to downgrade to version 2.0.1 of the stream-combine package and take necessary steps to secure any potentially compromised credentials or credit card information.
