Malicious Code in ui-common-components-angular (npm)
Summary
MAL-2024-1274: Malicious code in ui-common-components-angular (npm). Affects ui-common-components-angular versions 1.3.1 – 3.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ui-common-components-angular package is an open-source package available on the npm registry. It provides common UI components for Angular applications. The package is widely used by developers to enhance the user interface of their Angular projects. However, a specific version of this package, 1.3.1, has been identified as containing malicious code.
Vulnerability Detail
The malicious code in version 1.3.1 of ui-common-components-angular package has been identified by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity and executes one or more commands that exhibit malicious behavior. This can potentially lead to unauthorized access, data breaches, or other security risks for applications that depend on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ui-common-components-angularIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to update to a non-malicious version of the package.
Conclusion
The ui-common-components-angular package version 1.3.1 has been identified as containing malicious code. It is crucial to update to a non-malicious version of the package and regularly monitor and update dependencies to ensure the security of your application. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ui-common-components-angular →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
The malicious code in the ui-common-components-angular package can lead to unauthorized access, data breaches, or other security risks for applications that depend on it. Attackers may exploit this vulnerability to gain control over the affected application or steal sensitive data.
Specific known exploits for this vulnerability have not been mentioned. However, the presence of malicious code in the package increases the risk of potential exploits by attackers.
Yes, the recommended fix is to update the ui-common-components-angular package to a non-malicious version. It is important to regularly check for updates and apply them to ensure the security of your application.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability and ensuring the security of your application.
