Critical Vulnerability in yeoman-generator: Malicious Package
Summary
GHSA-f7g4-fm4c-54m9: Malicious Package in yeoman-genrator. Affects yeoman-genrator versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yeoman-generator is an npm package used for generating scaffolds, boilerplates, and templates for web applications. It provides a command-line interface (CLI) tool called 'yo' that allows developers to create and manage projects easily. The package is widely used in the JavaScript ecosystem and has a large user base. However, version 2.0.2 of yeoman-generator contains a malicious code as a preinstall script, making it vulnerable to exploitation.
Vulnerability Detail
The vulnerability in yeoman-generator version 2.0.2 arises from the presence of a malicious code in its preinstall script. When users mistakenly install this package, it downloads a file from a remote server, executes it, and opens a backdoor on the compromised system. This backdoor provides full control to an external entity, compromising the security of the affected computer. Any secrets or keys stored on the compromised system should be rotated immediately from a different computer to prevent further exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to follow the recommended steps mentioned in the 'how_to_fix' section to mitigate the risk and secure the affected systems.
Conclusion
The presence of a malicious package in yeoman-generator version 2.0.2 poses a critical security risk to systems that have installed or are running this package. It is essential to identify and remove the package from affected systems, rotate all sensitive information, and conduct a security audit. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yeoman-genrator →
FAQ
yeoman-generator is an npm package used for generating scaffolds, boilerplates, and templates for web applications. It provides a command-line interface (CLI) tool called 'yo' that simplifies project creation and management.
Version 2.0.2 of yeoman-generator is affected by this vulnerability.
The malicious code in yeoman-generator version 2.0.2 downloads a file from a remote server, executes it, and opens a backdoor on the compromised system. This backdoor provides full control to an external entity.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
If your system is affected, follow the recommended steps mentioned in the 'how_to_fix' section to mitigate the risk and secure your system. Additionally, consider conducting a thorough security audit to ensure no other malicious software or backdoors are present.
References
Related vulnerabilities
Recent vulnerabilities recorded for yeoman-genrator.
