Find, fix and prevent vulnerabilities in your code.
critical severity
new
- Vulnerable module: debug
- Introduced through: pacote@21.0.1
Detailed paths
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › sigstore@4.0.0 › @sigstore/tuf@4.0.0 › tuf-js@4.0.0 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › npm-registry-fetch@19.0.0 › make-fetch-happen@15.0.1 › @npmcli/agent@3.0.0 › http-proxy-agent@7.0.2 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › npm-registry-fetch@19.0.0 › make-fetch-happen@15.0.1 › @npmcli/agent@3.0.0 › https-proxy-agent@7.0.6 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › npm-registry-fetch@19.0.0 › make-fetch-happen@15.0.1 › @npmcli/agent@3.0.0 › socks-proxy-agent@8.0.5 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › @npmcli/run-script@10.0.0 › node-gyp@11.4.2 › make-fetch-happen@14.0.3 › @npmcli/agent@3.0.0 › http-proxy-agent@7.0.2 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › sigstore@4.0.0 › @sigstore/sign@4.0.0 › make-fetch-happen@15.0.1 › @npmcli/agent@3.0.0 › http-proxy-agent@7.0.2 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › @npmcli/run-script@10.0.0 › node-gyp@11.4.2 › make-fetch-happen@14.0.3 › @npmcli/agent@3.0.0 › https-proxy-agent@7.0.6 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › sigstore@4.0.0 › @sigstore/sign@4.0.0 › make-fetch-happen@15.0.1 › @npmcli/agent@3.0.0 › https-proxy-agent@7.0.6 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › @npmcli/run-script@10.0.0 › node-gyp@11.4.2 › make-fetch-happen@14.0.3 › @npmcli/agent@3.0.0 › socks-proxy-agent@8.0.5 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › sigstore@4.0.0 › @sigstore/sign@4.0.0 › make-fetch-happen@15.0.1 › @npmcli/agent@3.0.0 › socks-proxy-agent@8.0.5 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › sigstore@4.0.0 › @sigstore/tuf@4.0.0 › tuf-js@4.0.0 › make-fetch-happen@15.0.1 › @npmcli/agent@3.0.0 › http-proxy-agent@7.0.2 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › sigstore@4.0.0 › @sigstore/tuf@4.0.0 › tuf-js@4.0.0 › make-fetch-happen@15.0.1 › @npmcli/agent@3.0.0 › https-proxy-agent@7.0.6 › debug@4.4.3
-
Introduced through: npm-dep-graph@arlac77/npm-dep-graph#dd9516fe4648e5d94b2a91a5f7a747586d06d206 › pacote@21.0.1 › sigstore@4.0.0 › @sigstore/tuf@4.0.0 › tuf-js@4.0.0 › make-fetch-happen@15.0.1 › @npmcli/agent@3.0.0 › socks-proxy-agent@8.0.5 › debug@4.4.3
Overview
debug is a malicious package. This package version contains malicious code that listens for network traffic when run in the context of a browser and focuses on crypto transactions. The malicious code injected to the packages activates a hook whenever a Web3 wallet is present. Once activated the code intercepts and modifies any transaction with ETH value and points it to another address presumably controlled by the attacker. The malicious code also listens for swap/transfer transactions to tamper with as well.
Note:
This advisory is under ongoing investigation and can be updated with additional details.
Remediation
Avoid using all malicious instances of the debug package.