GHSA-jxf5-7x3j-8j9m Malicious Package in load-from-cwd-or-npm
Malicious code in the load-from-cwd-or-npm npm package allows attackers to execute arbitrary code during installation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-jxf5-7x3j-8j9m?
GHSA-jxf5-7x3j-8j9m is a vulnerability in load-from-cwd-or-npm, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Version 3.0.2 of load-from-cwd-or-npm contains malicious code. The malware breaks functionality of the purescript-installer package by injecting targeted code.
Recommendation
Upgrade to version 3.0.4 or later. There is no indication of further compromise.
Which versions are affected by GHSA-jxf5-7x3j-8j9m?
2 open source packages ship an affected version, including load-from-cwd-or-npm.
| Package | Affected | Fixed in |
|---|---|---|
load-from-cwd-or-npm npm | From 3.0.2 | 3.0.4 |
load-from-cwd-or-npm npm | From 3.0.2 | 3.0.4 |
How do I fix GHSA-jxf5-7x3j-8j9m?
Upgrade load-from-cwd-or-npm to 3.0.4 or later.
Is GHSA-jxf5-7x3j-8j9m being exploited?
There is no known exploitation of GHSA-jxf5-7x3j-8j9m in the wild and no public exploit code.