MAL-2023-462

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fsevents/MAL-2023-462.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2023-462

Aliases

GHSA-xv2f-5jw4-v95m

Published

2023-04-27T19:20:00Z

Modified

2023-11-08T04:24:32.787594Z

Summary

Malicious code in fsevents (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: ghsa-malware (acdc3ae57250fab51aeff6e3938ed40197a1b74eb688a72cd5d7eee0c77a7167)

This advisory is intended to inform the npm ecosystem with details to resolve a third-party malware incident that may have impacted your infrastructure if you are directly or transitively dependent on the fsevents npm package.

Overview

fsevents v1.0.0 <= v1.2.10 downloaded binary executables that contained unintended code due to an expired cloud storage resource being reclaimed by a third party.

Details

The fsevents npm package v1.0.0 through v1.2.10 attempts to fetch a pre-built binary executable artifact (fse.node) from cloud storage. If this fetch fails, fsevents v1.x will attempt to build this artifact directly from source.

Version 1.x of fsevents has been deprecated for several years and as a result the aforementioned cloud storage resource namespace was available for registration. A third party, unrelated to the fsevents maintainers, subsequently claimed this namespace and in April 2023 this third party started serving modified versions of the “fse.node” binary executable artifact to new fsevents v1.x users.

As of April 27, 2023 the cloud storage resource in question has been indefinitely suspended and is no longer serving binaries.

The affected cloud storage pre-fetch was removed in fsevents version 1.2.11.

Impact

The impact of the modified versions of fse.node appears to be limited to information gathering.

Note that initial analysis was performed for the modified artifact associated with fsevents v1.2.9, which was distributed as fse-v1.2.9-node-v72-darwin-x64.tar.gz prior to the cloud storage resource being suspended.

For more detailed analysis you may compare a decompilation of the v1.x fse.node artifacts on your systems with the intended fsevents v1.x source as it exists at https://github.com/fsevents/fsevents/tree/v1.x

How to fix it

If you are dependent on the deprecated version of fsevents v1.x, the recommended course of action is to upgrade to fsevents v2.x or remove the dependency altogether as currently maintained versions of Node.js no longer require fsevents for file system watching on macOS.

References

Affected packages

npm / fsevents

Package

Name: fsevents; View open source insights on deps.dev
Purl: pkg:npm/fsevents

Affected ranges

Type: SEMVER
Events: Introduced

1.0.0

Fixed

1.2.11

Database specific

{
    "cwes": [
        {
            "description": "The product contains code that appears to be malicious in nature.",
            "cweId": "CWE-506",
            "name": "Embedded Malicious Code"
        }
    ]
}