Embedded Malicious Code Affecting ua-parser-js package, versions >=1.0.0 <1.0.1 >=0.8.0 <0.8.1 >=0.7.29 <0.7.30


0.0
critical

Snyk CVSS

    Exploit Maturity Mature
    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-UAPARSERJS-1766952
  • published 24 Oct 2021
  • disclosed 22 Oct 2021
  • credit Unknown

Introduced: 22 Oct 2021

Malicious CVE NOT AVAILABLE CWE-506 Open this link in a new tab

How to fix?

Upgrade ua-parser-js to version 1.0.1, 0.8.1, 0.7.30 or higher.

Overview

ua-parser-js is a lightweight JavaScript-based user-agent string parser.

Affected versions of this package are vulnerable to Embedded Malicious Code. A hijack in the maintainer's NPM account led to including an embedded malicious crypto minor in this package, in three versions published versions (preinstall scripts). Specifically, the malicious code reads browser user data files, exports OS credentials copies the cookies DB file from the browser.

Users of affected versions should upgrade as soon as possible and check their systems for suspicious activity. Additionally, all secrets and keys stored on that computer should be rotated immediately from a different computer.

References