Malicious Package Affecting glup-debugger-log package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-GLUPDEBUGGERLOG-7176009
- published 2 Jun 2024
- disclosed 1 Jun 2024
- credit Phylum Research Team
How to fix?
Avoid using all malicious instances of the glup-debugger-log package.
Overview
glup-debugger-log is a malicious package.
This package contains malicious codes, in which the first script, play.js, acts as a malware dropper or a loader. It checks the environment based on a provided configuration and a few hard-coded requirements. It also has the capability to execute arbitrary commands from a URL or a local file, and it launches play-safe.js in detached mode to establish persistence.
The second script, play-safe.js establishes an HTTP server, it listens on port 3004 for incoming commands and executes them via child_process.