Malicious code in vscode-dev-containers (npm)
Summary
MAL-2024-3833: Malicious code in vscode-dev-containers (npm). Affects vscode-dev-containers versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
vscode-dev-containers is an open-source package available on npm. It is designed to provide development container definitions and scripts for Visual Studio Code. This package allows developers to easily set up and configure development environments within containers. However, a vulnerability has been discovered in the package that exposes users to malicious code.
Vulnerability Detail
The vulnerability (MAL-2024-3833) in vscode-dev-containers is due to the presence of malicious code within the package. The code was identified and reported by ReversingLabs. The malicious code can potentially lead to unauthorized access, data breaches, or other malicious activities. The specific details of the code and its impact are not provided in the vulnerability report.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vscode-dev-containersIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned in the vulnerability report. However, users can mitigate the risk by avoiding the use of the affected package version (1.0.0) and updating to a secure version as soon as possible.
Conclusion
The vscode-dev-containers package has been found to contain malicious code in version 1.0.0. This vulnerability can potentially lead to unauthorized access and data breaches. It is crucial for users to update to a secure version of the package and obtain the update from a trusted source.
See every vulnerability recorded for vscode-dev-containers →
FAQ
vscode-dev-containers is an npm package that provides development container definitions and scripts for Visual Studio Code.
The report does not provide specific details about the impact of the malicious code. However, it can potentially lead to unauthorized access, data breaches, or other malicious activities.
To fix the vulnerability, update the vscode-dev-containers package to a version that does not contain the malicious code. Avoid using the affected package version (1.0.0) and ensure the update is obtained from a trusted source.
No specific workaround is mentioned in the vulnerability report. However, users can mitigate the risk by updating to a secure version of the package.
The vulnerability was discovered by ReversingLabs, a security research firm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
