What is GHSA-j8qr-rvcv-crhv?

GHSA-j8qr-rvcv-crhv is a security advisory published by GitHub Security Advisories with Critical severity. Malicious Package in electron-native-notify

Why does GHSA-j8qr-rvcv-crhv have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-j8qr-rvcv-crhv?

GHSA-j8qr-rvcv-crhv affects 1 product, including: npm/electron-native-notify:\u003e= 0.

GHSA-j8qr-rvcv-crhvCriticalDisclosed before NVD

Malicious Package in electron-native-notify

Vendor

GitHub Security Advisories

Published

September 11, 2020

Last Modified

January 9, 2023

📋 Description

All versions of electron-native-notify contain malicious code. The package was part of a targeted attack to steal cryptocurrency wallet seeds and upload them to a remote server, effectively giving attackers access to users wallets.

Recommendation

Remove the package from your environment and follow the recommendations by Komodo

🎯 Affected products1

npm/electron-native-notify:>= 0

🔗 References (4)

https://blog.npmjs.org/post/185397814280/plot-to-steal-cryptocurrency-foiled-by-the-npm
https://komodoplatform.com/vulnerability-discovered-in-komodos-agama-wallet-this-is-what-you-need-to-do/
https://www.npmjs.com/advisories/927
https://github.com/advisories/GHSA-j8qr-rvcv-crhv