Malicious Code in zf-apigility (npm)
Summary
MAL-2023-8317: Malicious code in zf-apigility (npm). Affects zf-apigility versions 3.3.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
zf-apigility is an npm package that provides a framework for building and managing APIs in the Zend Framework. It offers various features and tools to simplify the development process. However, version 3.3.3 of zf-apigility has been identified as malicious by the OpenSSF Package Analysis project.
Vulnerability Detail
The package has been flagged as malicious due to the following reasons:
- It communicates with a domain associated with malicious activity.
- It executes one or more commands associated with malicious behavior. The specific details of these commands are not provided.
This vulnerability can potentially lead to unauthorized access, data breaches, or other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall zf-apigilityIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to follow the steps mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the zf-apigility package version 3.3.3 has been identified as malicious. It is crucial to remove or update this package to protect your application from potential security risks. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for zf-apigility →
FAQ
zf-apigility is an npm package that provides a framework for building and managing APIs in the Zend Framework. It offers various features and tools to simplify the development process.
This vulnerability can potentially lead to unauthorized access, data breaches, or other malicious activities. It is important to remove or update the malicious package to ensure the security of your application.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
Yes, the recommended fix is to remove or update the zf-apigility package to a non-malicious version. You can do this by running the command 'npm uninstall zf-apigility'.
To prevent similar vulnerabilities, it is important to regularly update your application's dependencies and ensure that all packages are from trusted sources. Additionally, using a vulnerability monitoring tool like Vulert can help you stay informed about any potential security issues.
