PT-2021-24418 · Npm · Rc
Published
2021-11-04
·
Updated
2021-11-04
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
npm package
rc versions 1.2.9, 1.3.9, and 2.3.9Description:
The npm package
rc had versions published with malicious code, which can fully compromise any computer that has this package installed or running. Users should check their systems for suspicious activity. All secrets and keys stored on the compromised computer should be rotated immediately from a different computer.Recommendations:
For versions 1.2.9, 1.3.9, and 2.3.9, downgrade to version 1.2.8 as soon as possible.
Remove the
rc package, but be aware that this may not remove all malicious software resulting from installing it.
Consider the computer fully compromised and take necessary actions to secure it, such as rotating secrets and keys from a different computer.RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rc