Malicious Package Affecting arduino-ide-extension package, versions *


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Mature

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JS-ARDUINOIDEEXTENSION-6044717
  • published3 Nov 2023
  • disclosed3 Nov 2023
  • creditPhylum Research Team

Introduced: 3 Nov 2023

Malicious CVE NOT AVAILABLE CWE-506  (opens in a new tab)

How to fix?

Avoid using all malicious instances of the arduino-ide-extension package.

Overview

arduino-ide-extension is a malicious package. The attack chain is triggered by package installation via an install hook in the package.json. The malicious code constructs an object o that aggregates various pieces of system information, such as the operating system's platform, architecture, release version, CPU information, network interfaces, and user information after which it exfiltrates the data to a malicious host.

References

CVSS Scores

version 3.1