CWE-506
Allowed-with-ReviewEmbedded Malicious Code
Abstraction: Class · Status: Incomplete
The product contains code that appears to be malicious in nature.
524 vulnerabilities reference this CWE, most recent first.
GHSA-W62P-HX95-GF2C
Vulnerability from github – Published: 2025-09-09 14:39 – Updated: 2025-09-10 21:08The DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of duckdb’s packages that included malicious code to interfere with cryptocoin transactions. The following packages and versions are affected:
@duckdb/node-api@1.3.3@duckdb/node-bindings@1.3.3duckdb@1.3.3@duckdb/duckdb-wasm@1.29.2
Note: The current release version of DuckDB is 1.3.2, with 1.4.0 expected to be released on Sept 10th, 2025 (tomorrow as of this writing). We do not plan to ever release a “legit” DuckDB 1.3.3. Users should double-check that they are not accidentally updating to those affected versions.
We have ourselves noticed this within four hours of it happening. Here’s our response:
- As an immediate response, we have deprecated the specific versions.
- We have reached out to npm support to delete the affected versions. They were so kind to do so.
- We have also re-released the node packages with higher version numbers (1.3.4/1.30.0) as a further safeguard so the latest version of the package points to a safe version
We apologize for this issue. We are reviewing our internal processes to ensure the safety of future releases.
Postmortem
On September 8th (Monday), the DuckDB maintainers received the following message from "...@npmjs.help":
One of the maintainers read through this text and found it somewhat reasonable. He followed the link (now defunct) to a website hosted under the domain npmjs.help. This website contained a pixel-perfect copy of the npmjs.com website. He logged in using the duckdb_admin user and password, followed by 2FA. Again, the user profile, settings etc. were a perfect copy of the npmjs.com website including all user data. As requested by the email, he then re-set the 2FA setup.
In the background, the copycat website forwarded all actions to the actual npm website, so the 2FA was actually updated there, too. But they also added a new API token, which they then used to publish the malicious package versions. In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. It's painful to spell out, but we fell for a classic phishing attack.
We again apologize for this mishap. We are reviewing our internal processes to ensure the safety of future releases. It is fortunate that we noticed this within a few hours of it happening. The DuckDBLabs team was able to set up a call at 7AM to perform an immediate response. Fortunately we were not locked out of our NPM account, which also easily could have happened. We were able to rotate passwords, tokens and API keys immediately.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "duckdb"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.3"
},
{
"fixed": "1.3.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.3.3"
]
},
{
"package": {
"ecosystem": "npm",
"name": "@duckdb/node-api"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.3"
},
{
"fixed": "1.3.4-alpha.27"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.3.3"
]
},
{
"package": {
"ecosystem": "npm",
"name": "@duckdb/node-bindings"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.3"
},
{
"fixed": "1.3.4-alpha.27"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.3.3"
]
},
{
"package": {
"ecosystem": "npm",
"name": "@duckdb/duckdb-wasm"
},
"ranges": [
{
"events": [
{
"introduced": "1.29.2"
},
{
"fixed": "1.30.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.29.2"
]
}
],
"aliases": [
"CVE-2025-59037"
],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-09T14:39:14Z",
"nvd_published_at": "2025-09-09T21:15:39Z",
"severity": "HIGH"
},
"details": "The DuckDB distribution for [Node.js](http://node.js/) on [npm](https://www.npmjs.com/) was compromised with malware (along with [several other packages](https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised)). An attacker published new versions of four of duckdb\u2019s packages that included **malicious code to interfere with cryptocoin transactions**. The following packages and versions are affected:\n\n- `@duckdb/node-api@1.3.3`\n- `@duckdb/node-bindings@1.3.3`\n- `duckdb@1.3.3`\n- `@duckdb/duckdb-wasm@1.29.2`\n\n\u003e Note: The current release version of DuckDB is 1.3.2, with 1.4.0 expected to be released on Sept 10th, 2025 (tomorrow as of this writing). We do not plan to ever release a \u201clegit\u201d DuckDB 1.3.3. Users should double-check that they are not accidentally updating to those affected versions. \n\n\nWe have ourselves noticed this *within four hours* of it happening. Here\u2019s our response:\n\n- As an immediate response, we have **deprecated** the specific versions. \n- We have reached out to npm support to **delete the affected versions**. They were so kind to do so.\n- We have also **re-released** the node packages with higher version numbers (1.3.4/1.30.0) as a further safeguard so the latest version of the package points to a safe version\n\nWe apologize for this issue. We are reviewing our internal processes to ensure the safety of future releases.\n\n### Postmortem ###\n\nOn September 8th (Monday), the DuckDB maintainers received the following message from \"...@npmjs.help\":\n\n\u003cimg width=\"1134\" height=\"614\" alt=\"Screenshot 2025-09-09 at 11 07 09\" src=\"https://github.com/user-attachments/assets/0ce24798-1f5a-40b0-ac50-49035d99862b\" /\u003e\n\nOne of the maintainers read through this text and found it somewhat reasonable. He followed the link (now defunct) to a website hosted under the domain `npmjs.help`. This website contained a **pixel-perfect copy** of the [npmjs.com](http://npmjs.com/) website. He logged in using the `duckdb_admin` user and password, followed by 2FA. Again, the user profile, settings etc. were a perfect copy of the [npmjs.com](http://npmjs.com/) website including all user data. As requested by the email, he then re-set the 2FA setup. \n\nIn the background, the copycat website forwarded all actions to the actual npm website, so the 2FA was actually updated there, too. But they also added a new API token, which they then used to publish the malicious package versions. In hindsight, the fact that his browser did not auto-complete the login should have been a red flag. It\u0027s painful to spell out, but **we fell for a classic phishing attack**.\n\nWe again apologize for this mishap. We are reviewing our internal processes to ensure the safety of future releases. It is fortunate that we noticed this within a few hours of it happening. The DuckDBLabs team was able to set up a call at 7AM to perform an immediate response. Fortunately we were not locked out of our NPM account, which also easily could have happened. We were able to rotate passwords, tokens and API keys immediately.",
"id": "GHSA-w62p-hx95-gf2c",
"modified": "2025-09-10T21:08:58Z",
"published": "2025-09-09T14:39:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59037"
},
{
"type": "PACKAGE",
"url": "https://github.com/duckdb/duckdb-node"
},
{
"type": "WEB",
"url": "https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4"
},
{
"type": "WEB",
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware"
}
GHSA-W65V-HX54-XRQX
Vulnerability from github – Published: 2020-09-03 17:41 – Updated: 2021-09-30 19:50All versions of midway-xtpl contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.
Recommendation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "midway-xtpl"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:45:45Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `midway-xtpl` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-w65v-hx54-xrqx",
"modified": "2021-09-30T19:50:35Z",
"published": "2020-09-03T17:41:23Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1057"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in midway-xtpl"
}
GHSA-W7WG-24G3-2C78
Vulnerability from github – Published: 2020-09-02 21:14 – Updated: 2021-09-30 20:29All versions of requset typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.
Recommendation
Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "requset"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:38:50Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `requset` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.\n\n\n## Recommendation\n\nRemove the package from your dependencies and always ensure package names are typed correctly upon installation.",
"id": "GHSA-w7wg-24g3-2c78",
"modified": "2021-09-30T20:29:47Z",
"published": "2020-09-02T21:14:17Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/869"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in requset"
}
GHSA-W8FH-PVQ2-X8C4
Vulnerability from github – Published: 2021-01-29 18:11 – Updated: 2021-01-29 18:10The npm sonatype package has been identified as malicious and removed from the npm package registry.
Remediation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sonatype"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2021-01-29T18:10:59Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "The npm `sonatype` package has been identified as malicious and removed from the npm package registry.\n\n## Remediation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-w8fh-pvq2-x8c4",
"modified": "2021-01-29T18:10:59Z",
"published": "2021-01-29T18:11:20Z",
"references": [
{
"type": "WEB",
"url": "https://blog.sonatype.com/sonatype-spots-more-discord-malware-in-npm?hs_preview=BbDPGbfh-40737456755"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1596"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Malicious npm package: sonatype"
}
GHSA-W8HG-MXVH-9H57
Vulnerability from github – Published: 2020-09-01 19:42 – Updated: 2021-09-24 14:49Version 0.0.9 of angular-bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=
Recommendation
If version 0.0.9 of this module is found installed you will want to replace it with a version before or after 0.0.9. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "angular-bmap"
},
"versions": [
"0.0.9"
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:29:57Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Version 0.0.9 of `angular-bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 0.0.9 of this module is found installed you will want to replace it with a version before or after 0.0.9. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.",
"id": "GHSA-w8hg-mxvh-9h57",
"modified": "2021-09-24T14:49:19Z",
"published": "2020-09-01T19:42:49Z",
"references": [
{
"type": "PACKAGE",
"url": "https://github.com/shenfw1987/angular-bmap"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-ANGULARBMAP-451017"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/614"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in angular-bmap"
}
GHSA-W9HW-V97W-G5F5
Vulnerability from github – Published: 2020-09-04 16:43 – Updated: 2021-10-01 20:43All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.
Recommendation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bitconi-ops"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:56:41Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-w9hw-v97w-g5f5",
"modified": "2021-10-01T20:43:23Z",
"published": "2020-09-04T16:43:14Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1368"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in bitconi-ops"
}
GHSA-W9Q5-MVC6-5CW3
Vulnerability from github – Published: 2020-09-03 21:45 – Updated: 2021-09-29 20:56Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.
Recommendation
Remove the package from your environment. Ensure no Ethereum funds were compromised.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bufder-xor"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:51:48Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.\n\n\n## Recommendation\n\nRemove the package from your environment. Ensure no Ethereum funds were compromised.",
"id": "GHSA-w9q5-mvc6-5cw3",
"modified": "2021-09-29T20:56:43Z",
"published": "2020-09-03T21:45:13Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1235"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in bufder-xor"
}
GHSA-WC7Q-QPM4-8PQV
Vulnerability from github – Published: 2020-09-02 20:32 – Updated: 2021-10-01 14:07All versions of rrequest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.
Recommendation
Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "rrequest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:38:34Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `rrequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.\n\n\n## Recommendation\n\nRemove the package from your dependencies and always ensure package names are typed correctly upon installation.",
"id": "GHSA-wc7q-qpm4-8pqv",
"modified": "2021-10-01T14:07:12Z",
"published": "2020-09-02T20:32:10Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/862"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in rrequest"
}
GHSA-WCH2-46WJ-6X5J
Vulnerability from github – Published: 2020-09-04 15:37 – Updated: 2021-10-01 20:38All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.
Recommendation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bip30"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-506"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:56:18Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"id": "GHSA-wch2-46wj-6x5j",
"modified": "2021-10-01T20:38:52Z",
"published": "2020-09-04T15:37:15Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1358"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Malicious Package in bip30"
}
GHSA-WF54-F8V9-V72V
Vulnerability from github – Published: 2024-05-23 03:30 – Updated: 2025-10-22 00:33Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.
{
"affected": [],
"aliases": [
"CVE-2024-4978"
],
"database_specific": {
"cwe_ids": [
"CWE-502",
"CWE-506"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-23T02:15:09Z",
"severity": "HIGH"
},
"details": "Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.",
"id": "GHSA-wf54-f8v9-v72v",
"modified": "2025-10-22T00:33:02Z",
"published": "2024-05-23T03:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4978"
},
{
"type": "WEB",
"url": "https://twitter.com/2RunJack2/status/1775052981966377148"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4978"
},
{
"type": "WEB",
"url": "https://www.javs.com/downloads"
},
{
"type": "WEB",
"url": "https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
CAPEC-442: Infected Software
An adversary adds malicious logic, often in the form of a computer virus, to otherwise benign software. This logic is often hidden from the user of the software and works behind the scenes to achieve negative impacts. Many times, the malicious logic is inserted into empty space between legitimate code, and is then called when the software is executed. This pattern of attack focuses on software already fielded and used in operation as opposed to software that is still under development and part of the supply chain.
CAPEC-448: Embed Virus into DLL
An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.
CAPEC-636: Hiding Malicious Data or Code within Files
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.