Malicious Package in uglyfi.js - Open Source Vulnerability
Summary
GHSA-8jf2-cq6v-w234: Malicious Package in uglyfi.js. Affects uglyfi.js versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
uglyfi.js is an npm package used for [provide brief description of the package functionality]. It is vulnerable to a critical security issue that involves the presence of malicious code in version 0.17.3. This code is executed as a preinstall script and can compromise the entire system. The package is designed to exploit user typos when installing modules, leading to the download and execution of a remote file that opens a backdoor on the affected system.
Vulnerability Detail
The vulnerability (GHSA-8jf2-cq6v-w234) in uglyfi.js version 0.17.3 allows an attacker to gain full control of any system where the package is installed. The malicious code is executed during the package installation process, enabling the attacker to download and execute arbitrary files on the compromised system. This can result in unauthorized access, data theft, and the potential for further malicious activities. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to follow the recommended steps for fixing the issue and securing the compromised systems.
Conclusion
The presence of a malicious package in uglyfi.js version 0.17.3 poses a critical security risk to any system where it is installed. It is recommended to immediately identify and secure all affected systems by rotating keys and secrets, removing the package, and conducting a thorough security audit. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for uglyfi.js →
FAQ
The impact of this vulnerability is severe. Any system with the affected version of uglyfi.js installed is fully compromised, allowing unauthorized access and potential data theft.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
While removing the uglyfi.js package is recommended, it does not guarantee the removal of all malicious software resulting from its installation. A thorough security audit is necessary to ensure the system is fully secure.
There are no known mitigations for this vulnerability. It is crucial to follow the recommended steps for fixing the issue and securing the compromised systems.
To prevent similar vulnerabilities, it is important to regularly update packages to their latest versions, verify the integrity of packages before installation, and implement security measures such as code reviews and vulnerability scanning.
References
Related vulnerabilities
Recent vulnerabilities recorded for uglyfi.js.
