Malicious Code in watchman-search-ui (npm)
Summary
MAL-2023-8443: Malicious code in watchman-search-ui (npm). Affects watchman-search-ui versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
watchman-search-ui is an npm package that provides a user interface for searching and managing files using the Watchman file watching service. It is commonly used in web development projects to enhance file search capabilities. However, the package has been identified as malicious by the OpenSSF Package Analysis project.
Vulnerability Detail
The watchman-search-ui package at version 1.0.0 contains malicious code that executes one or more commands associated with malicious behavior. This code can potentially compromise the security and integrity of the system where the package is installed. The origin of this malicious code is the OpenSSF Package Analysis project, which has flagged this version of the package as malicious.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall watchman-search-uiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to remove the affected package and find a suitable replacement.
Conclusion
The watchman-search-ui package at version 1.0.0 has been identified as malicious by the OpenSSF Package Analysis project. It contains code that executes malicious commands, posing a potential security risk to systems where the package is installed. It is recommended to remove the package and find a trusted alternative. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for watchman-search-ui →
FAQ
watchman-search-ui is an npm package that provides a user interface for searching and managing files using the Watchman file watching service.
The malicious code in watchman-search-ui can execute commands associated with malicious behavior, potentially compromising the security and integrity of your system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your package-lock.json file to the playground, and it will alert you in real-time for any open-source vulnerabilities, including this one.
Yes, the recommended fix is to remove the watchman-search-ui package from your project and replace it with a trusted alternative.
To prevent similar vulnerabilities, it is essential to regularly update and review the packages used in your project. Additionally, consider using tools like Vulert (https://vulert.com) to monitor and alert in real-time for open-source vulnerabilities in your software.
