GHSA-73hr-6785-f5p8 Malicious Package in donotinstallthis
A malicious npm package executes a script during installation to track installs, requiring removal to prevent unauthorized data transmission.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is GHSA-73hr-6785-f5p8?
GHSA-73hr-6785-f5p8 is a vulnerability in donotinstallthis, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The package donotinstallthis contained malicious code. The package contained a script that was run as part of the install script. The script contacted a remote service tracking how many installations were done. There is no further compromise.
Recommendation
Remove the package from your environment.
Which versions are affected by GHSA-73hr-6785-f5p8?
2 open source packages ship an affected version, including donotinstallthis.
| Package | Affected | Fixed in |
|---|---|---|
donotinstallthis npm | All versions | None |
donotinstallthis npm | All versions | None |
How do I fix GHSA-73hr-6785-f5p8?
No fix has been published for GHSA-73hr-6785-f5p8 yet. Limit exposure of the affected software until one is available.
Is GHSA-73hr-6785-f5p8 being exploited?
There is no known exploitation of GHSA-73hr-6785-f5p8 in the wild and no public exploit code.