GMS-2020-502: Malicious Package

September 3, 2020 (updated September 30, 2021)

All versions of sdfjghlkfjdshlkjdhsfg contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version. ## Recommendation

Remove the package from your environment and ensure all packages owned were not impacted.

References

github.com/advisories/GHSA-gcfc-mgg3-8j2c
www.npmjs.com/advisories/1072

Code Behaviors & Features

Detect and mitigate GMS-2020-502 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →