Malicious Package Affecting pretty_color package, versions >=0.0.0
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Mature
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PRETTYCOLOR-1052070
- published 17 Dec 2020
- disclosed 17 Dec 2020
- credit Sonatype
How to fix?
Avoid using all malicious instances of the pretty_color package.
Overview
pretty_color is a malicious package.
Within version.rb, obfuscated code can be found which, on Windows systems, generates and runs a malicious VBScript the_Score.vbs. This script will:
- Create (drop) another malicious VBScript at
%PROGRAMDATA%\Microsoft Essentials\Software Essentials.vbs - This new VBScript monitors the user’s clipboard every second for a Bitcoin address and replaces it with the attacker’s wallet address
- To achieve persistence,
the_Score.vbsalso adds the path of the newly dropped Software Essentials.vbs to the appropriate Windows registry key, to make the malware run every time the system boots.