GHSA-cr5w-6rv4-r2qg Malicious Package in maleficent
The maleficent npm package collects sensitive system and credential data, requiring users to remove it to prevent local information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is GHSA-cr5w-6rv4-r2qg?
GHSA-cr5w-6rv4-r2qg is a vulnerability in maleficent, published on 3 Sep 2020.
Official description
All versions of maleficent contain malicious code. The package is a demonstration of possible risks when installing npm packages. It gathers system information such as: environment variables, OS information, network interface, AWS credentials, npm credentials and ssh keys. The package prints the information to a local file but does not upload it to a remote server.
Recommendation
Remove the package from your environment. There is no further compromise.
Which versions are affected by GHSA-cr5w-6rv4-r2qg?
2 open source packages ship an affected version, including maleficent.
| Package | Affected | Fixed in |
|---|---|---|
maleficent npm | All versions | None |
maleficent npm | All versions | None |
How do I fix GHSA-cr5w-6rv4-r2qg?
No fix has been published for GHSA-cr5w-6rv4-r2qg yet. Limit exposure of the affected software until one is available.
Is GHSA-cr5w-6rv4-r2qg being exploited?
There is no known exploitation of GHSA-cr5w-6rv4-r2qg in the wild and no public exploit code.