Malicious code in test-pocbb (npm)
Summary
MAL-2023-8465: Malicious code in test-pocbb (npm). Affects test-pocbb versions 1.0.0 – 1.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The test-pocbb package is an npm package that is used for testing purposes. It is part of the npm ecosystem and can be installed and used in various projects. The package is vulnerable to a malicious code injection.
Vulnerability Detail
The test-pocbb package has been found to contain malicious code. This code can compromise the security of any computer that has the package installed or running. It is advised to consider any computer with this package as fully compromised. All secrets and keys stored on the affected computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall test-pocbbIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The test-pocbb package has been found to contain malicious code, compromising the security of any computer with the package installed or running. It is crucial to remove the package and rotate all secrets and keys stored on the affected computer. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for test-pocbb →
FAQ
The impact of this vulnerability is that any computer with the test-pocbb package installed or running is considered fully compromised. All secrets and keys stored on the affected computer should be rotated immediately.
You can use the Vulert playground at Vulert Scanner to check if your computer is affected by this vulnerability. Simply input your package-lock.json file and it will alert you in real-time.
Removing the test-pocbb package is recommended, but it may not guarantee the removal of all malicious software resulting from its installation. It is also important to rotate all secrets and keys stored on the affected computer.
If your computer is affected by this vulnerability, it is advised to rotate all secrets and keys stored on the affected computer from a different computer. This will help ensure their security.
It is recommended to search for alternative packages in the npm ecosystem that serve the same testing purposes as test-pocbb. Ensure to review the security and reputation of any alternative package before installation.
