Malicious Code in supabase.dev (npm)
Summary
MAL-2023-8327: Malicious code in supabase.dev (npm). Affects supabase.dev versions 4.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
supabase.dev is an npm package that provides a set of tools and libraries for building applications with Supabase, an open-source alternative to Firebase. It offers a range of features such as authentication, real-time database, and file storage. However, the package has been identified as malicious by the OpenSSF Package Analysis project.
Vulnerability Detail
The supabase.dev package has been flagged as malicious due to the following reasons:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
This indicates that the package may perform unauthorized actions or compromise the security of the system it is installed on.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall supabase.devIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section.
Conclusion
The supabase.dev package has been identified as malicious, and it is crucial to take immediate action to remove it from your project. Replace it with a trusted alternative and regularly review your project's dependencies to ensure their integrity. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for supabase.dev →
FAQ
supabase.dev is an npm package that provides tools and libraries for building applications with Supabase, an open-source alternative to Firebase.
supabase.dev has been flagged as malicious because it communicates with a domain associated with malicious activity and executes commands related to malicious behavior.
Using supabase.dev can lead to unauthorized actions being performed or compromise the security of the system it is installed on.
To fix this vulnerability, remove the supabase.dev package from your project and replace it with a trusted alternative. Regularly review your project's dependencies to ensure they come from reputable sources.
No specific workaround is provided for this vulnerability. Following the recommended steps to fix the vulnerability is the best approach.
