GHSA-j8qr-rvcv-crhv Malicious Package in electron-native-notify
Malicious code in electron-native-notify steals cryptocurrency wallet seeds, requiring immediate removal of the package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-j8qr-rvcv-crhv?
GHSA-j8qr-rvcv-crhv is a vulnerability in electron-native-notify, published on 11 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of electron-native-notify contain malicious code. The package was part of a targeted attack to steal cryptocurrency wallet seeds and upload them to a remote server, effectively giving attackers access to users wallets.
Recommendation
Remove the package from your environment and follow the recommendations by Komodo
Which versions are affected by GHSA-j8qr-rvcv-crhv?
2 open source packages ship an affected version, including electron-native-notify.
| Package | Affected | Fixed in |
|---|---|---|
electron-native-notify npm | All versions | None |
electron-native-notify npm | All versions | None |
How do I fix GHSA-j8qr-rvcv-crhv?
No fix has been published for GHSA-j8qr-rvcv-crhv yet. Limit exposure of the affected software until one is available.
Is GHSA-j8qr-rvcv-crhv being exploited?
There is no known exploitation of GHSA-j8qr-rvcv-crhv in the wild and no public exploit code.