Homepage
About Snyk

Undesired Behavior Affecting moq package, versions [4.20.0,4.20.2)

0.0
low

Snyk CVSS

    Attack Complexity Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DOTNET-MOQ-5830586
  • published 9 Aug 2023
  • disclosed 8 Aug 2023
  • credit DinglDanglBob
Report a new vulnerability Found a mistake?

Introduced: 8 Aug 2023

CVE NOT AVAILABLE CWE-438 Open this link in a new tab
First added by Snyk

How to fix?

Upgrade Moq to version 4.20.2 or higher.

Overview

Affected versions of this package are vulnerable to Undesired Behavior. It contains a dependency on the SponsorLink package, which runs an obfuscated closed-source executable at buildtime.

That executable spawns OS processes and performs network requests, including transferring a derivative of personally identifying information (a hash of the email address of the developer from 'git config' output) to remote servers.

NOTE: This change in behavior is in development and this advisory will be updated as new information is available.