Vulnerability DatabaseGHSA-49c6-3wr4-8jr4

GHSA-49c6-3wr4-8jr4
JavaScript vulnerability analysis and mitigation

Overview

A critical security vulnerability was identified in the npm package 'malicious-npm-package' (GHSA-49c6-3wr4-8jr4). The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 4, 2020, and last updated on January 9, 2023. This malicious package affects all versions (>= 0.0.0) with no patched versions available (GitHub Advisory).

Technical details

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS v3 base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

Impact

The malware specifically targets Windows systems and executes a PowerShell command that downloads and runs an executable file from a remote server. Any system with this package installed should be considered fully compromised, potentially giving full control to malicious actors (GitHub Advisory).

Exploitability

The package contains malicious code that can be executed without user interaction and requires no special privileges, making it highly exploitable. The attack vector is network-based with low complexity, indicating easy exploitation (GitHub Advisory).

Mitigation and workarounds

It is recommended to immediately remove the package from affected systems. However, removal may not be sufficient as the system should be considered compromised. All secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised system. There are no patches available as this is a malicious package by design (GitHub Advisory).

Additional resources


SourceThis report was generated using AI

Related JavaScript vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

GHSA-7q9c-hpx7-9cwmHIGH7.5
  • JavaScript logoJavaScript
  • @typespec/spector
NoYesSep 04, 2026
CVE-2026-77465HIGH7.5
  • JavaScript logoJavaScript
  • cockpit-image-builder.src
NoYesSep 03, 2026
CVE-2026-85063MEDIUM6.9
  • JavaScript logoJavaScript
  • csv-parse
NoYesSep 03, 2026
CVE-2026-71429MEDIUM6.2
  • JavaScript logoJavaScript
  • stream-json
NoYesSep 03, 2026
GHSA-6hxq-p678-4hr2LOW2
  • JavaScript logoJavaScript
  • @simplewebauthn/server
NoYesSep 04, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management