CVE-2022-23812: YOUR CODE IS INFECTED WITH MALICIOUS DEPENDENCY - node-ipc

DevExpress / testcafe-browser-provider-electron

This is the Electron browser provider plugin for TestCafe.

https://testcafe.io

MIT License

49 stars 30 forks source link

CVE-2022-23812: YOUR CODE IS INFECTED WITH MALICIOUS DEPENDENCY - node-ipc #88

Closed lgg closed 2 years ago

lgg commented 2 years ago

Newest version of node-ipc delete all users's files from device. You should not use this dependency anymore!

You can learn more here: https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0c809c

Check possible solution that already applied in vue.js: https://github.com/vuejs/vue-cli/issues/7054#issuecomment-1068677029

also check more here: https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

AndreyBelym commented 2 years ago

Thank you, I'll fix this ASAP.

AndreyBelym commented 2 years ago

For now, I fixed node-ipc@9.2.1 in dependencies and published testcafe-browser-provider-electron@0.0.18. Since npm does not allow to modify already published packages, this is a quick and safe solution. We will try to abandon using node-ipc completely: #89.