Malicious Package Affecting protect-api package, versions *
Threat Intelligence
Exploit Maturity
Mature
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-PROTECTAPI-8180005
- published 10 Oct 2024
- disclosed 9 Oct 2024
How to fix?
Avoid using all malicious instances of the protect-api package.
Overview
protect-api is a malicious package. This package contains malicious code that is designed to delete the entire filesystem recursively and a Telegram bot that seems to be used for remote control by an attacker.