@injectivelabs/sdk-ts Malware Published in NPM Version 1.20.21
- Investigating(current)
- Trending(upcoming)
- Workaround available(upcoming)
- Resolved(upcoming)
Executive summary
A malicious version (1.20.21) of the @injectivelabs/sdk-ts npm package was published, potentially compromising any system where it is installed or run. Users are advised that all secrets and keys stored on affected machines must be rotated immediately from a separate device.
No verified workaround yet
None of the linked reports describe a mitigation. Follow this incident to hear when one appears.
Official fixMalicious code injected into npm package @injectivelabs/sdk-ts version 1.20.21.
Evidence
1 report · 1 CVEShow
- [1]CVE First report@injectivelabs/sdk-ts (npm): malicious versions 1.20.21 published(opens security advisory in a new tab)
Malicious code in @injectivelabs/sdk-ts (npm, 57,248 downloads last week), affected: 1.20.21. Malware in @injectivelabs/sdk-ts. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all…
by GitHub Advisory Database 0upvotes 0comments
Timeline
- First report on security advisory
@injectivelabs/sdk-ts (npm): malicious versions 1.20.21 published
Source