CVE-2019-19771 lodahs is malware
A malicious Node.js package masquerading as lodash exfiltrates cryptocurrency wallets from victims who install it by mistake.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-19771?
CVE-2019-19771 is a high-severity vulnerability in n/a, published on 12 Dec 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.
Which versions are affected by CVE-2019-19771?
2 open source packages ship an affected version, including lodahs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lodahs npm | From 0.0.1 | None |
lodahs npm | From 0.0.1 | None |
Products include Lodahs Project Lodahs.
How do I fix CVE-2019-19771?
No fix has been published for CVE-2019-19771 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-19771 being exploited?
There is no known exploitation of CVE-2019-19771 in the wild and no public exploit code.
Sources
Also known as GHSA-hm6q-r2jc-cpqh.