Skip to main content
MalwarePublished Updated

@telekom-wfa/auth-core (npm) · Malicious Code

Affects @telekom-wfa/auth-coreSource GCVE Database

0

What to do

Affected software

ProductAffectedFixed in
npm@telekom-wfa/auth-coreAffected
  • =99.9.11
  • =99.9.12
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @telekom-wfa/auth-core versions 99.9.11 and 99.9.12 contain malicious code. This malware includes hardcoded Telegram credentials, data exfiltration capabilities, and executes a preinstall script, indicating intentional malicious behavior. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated from a separate, secure device. Removal of the package alone may not eliminate all malicious components due to potential full system compromise.

References

Community reviews

Loading reviews…