Snyk has a published code exploit for this vulnerability.
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsAvoid using all malicious instances of the tsconfig-slick
package.
tsconfig-slick is a malicious package.
The attack chain is triggered by package installation via an install hook in the package.json
. The malicious code constructs an object o
that aggregates various pieces of system information, such as the operating system's platform, architecture, release version, CPU information, network interfaces, and user information after which it exfiltrates the data to a malicious host.