GHSA-6879-xr95-5gf4 Malicious Package in malicious-do-not-install
A malicious npm package steals system credentials by copying password files to a temporary directory, requiring immediate removal and credential rotation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-6879-xr95-5gf4?
GHSA-6879-xr95-5gf4 is a vulnerability in malicious-do-not-install, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of malicious-do-not-install contain malicious code. The package copies the contents of /etc/passwd and /etc/shadow to files in the local /tmp/ folder.
Recommendation
Remove the package from your environment and rotate affected credentials.
Which versions are affected by GHSA-6879-xr95-5gf4?
2 open source packages ship an affected version, including malicious-do-not-install.
| Package | Affected | Fixed in |
|---|---|---|
malicious-do-not-install npm | From 0.0.0 | None |
malicious-do-not-install npm | From 0.0.0 | None |
How do I fix GHSA-6879-xr95-5gf4?
No fix has been published for GHSA-6879-xr95-5gf4 yet. Limit exposure of the affected software until one is available.
Is GHSA-6879-xr95-5gf4 being exploited?
There is no known exploitation of GHSA-6879-xr95-5gf4 in the wild and no public exploit code.