Malicious Code in tkn-poc (npm)
Summary
MAL-2023-8495: Malicious code in tkn-poc (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tkn-poc package is an npm package that is used for [provide brief description of package functionality]. It is vulnerable to a malicious code injection that can compromise the security of any computer on which it is installed or running. This vulnerability has been identified in the package and immediate action is required to mitigate the potential risks.
Vulnerability Detail
The tkn-poc package contains a malicious code that has been identified as ghsa-malware (a3230b2e14e4f5e50ae022fdb7a081a52260e3c68f1a4b50add1dcca4afdc1a5). This code compromises the security of the computer on which the package is installed, giving full control to an outside entity. As a result, all secrets and keys stored on the affected computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tkn-pocIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to follow the steps mentioned in the 'how_to_fix' section to mitigate the risks.
Conclusion
The tkn-poc package has been identified as containing malicious code that compromises the security of the affected computer. Immediate action is required to rotate all secrets and keys stored on the computer, remove the package, and run a thorough security scan. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tkn-poc →
FAQ
tkn-poc is an npm package used for [provide brief description of package functionality].
The malicious code in tkn-poc, identified as ghsa-malware (a3230b2e14e4f5e50ae022fdb7a081a52260e3c68f1a4b50add1dcca4afdc1a5), gives full control of the affected computer to an outside entity. This compromises the security of the computer and puts all stored secrets and keys at risk.
If you have tkn-poc installed, it is recommended to immediately rotate all secrets and keys stored on the affected computer from a different computer. Remove the tkn-poc package and run a thorough security scan to ensure the removal of any remaining malicious software.
While removing the tkn-poc package is recommended, it may not guarantee the removal of all malicious software resulting from its installation. It is important to run a thorough security scan to identify and remove any remaining malicious software.
After removing tkn-poc, it is crucial to run a thorough security scan on the affected computer to identify and remove any remaining malicious software. Additionally, it is recommended to regularly update and patch all software and use reliable security measures to protect against future vulnerabilities.
