GHSA-p8fm-w787-x6x3 Malicious Package in portionfatty12
Malicious npm package steals SSH keys by uploading them to a remote server, requiring immediate credential rotation and system remediation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is GHSA-p8fm-w787-x6x3?
GHSA-p8fm-w787-x6x3 is a vulnerability in portionfatty12, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions of portionfatty12 are considered malicious. The package is malware designed to steal user's data. When installed it uploads the user's public SSH keys to a remote server.
Recommendation
This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.
Which versions are affected by GHSA-p8fm-w787-x6x3?
2 open source packages ship an affected version, including portionfatty12.
| Package | Affected | Fixed in |
|---|---|---|
portionfatty12 npm | From 0.0.0 | None |
portionfatty12 npm | From 0.0.0 | None |
How do I fix GHSA-p8fm-w787-x6x3?
No fix has been published for GHSA-p8fm-w787-x6x3 yet. Limit exposure of the affected software until one is available.
Is GHSA-p8fm-w787-x6x3 being exploited?
There is no known exploitation of GHSA-p8fm-w787-x6x3 in the wild and no public exploit code.