GHSA-8mm3-2mcj-cx6r Malicious Package in angluar-cli
A malicious npm package named angluar-cli deletes files and stops McAfee processes on macOS when installed by mistake.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is GHSA-8mm3-2mcj-cx6r?
GHSA-8mm3-2mcj-cx6r is a vulnerability in angluar-cli, published on 11 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Version 0.0.3 of angluar-cli contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus on macOS.
Recommendation
Remove the package from your environment and verify whether files were deleted and if processes were stopped.
Which versions are affected by GHSA-8mm3-2mcj-cx6r?
2 open source packages ship an affected version, including angluar-cli.
| Package | Affected | Fixed in |
|---|---|---|
angluar-cli npm | All versions | None |
angluar-cli npm | All versions | None |
How do I fix GHSA-8mm3-2mcj-cx6r?
No fix has been published for GHSA-8mm3-2mcj-cx6r yet. Limit exposure of the affected software until one is available.
Is GHSA-8mm3-2mcj-cx6r being exploited?
There is no known exploitation of GHSA-8mm3-2mcj-cx6r in the wild and no public exploit code.