Skip to content

Malicious npm package: discord-fix

Critical severity GitHub Reviewed Published Jan 29, 2021 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm discord-fix (npm)

Affected versions

>= 0.0.0

Patched versions

None

Description

The npm discord-fix package has been identified as malicious and removed from the npm package registry.

Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

Reviewed Jan 29, 2021
Published to the GitHub Advisory Database Jan 29, 2021
Last updated Jan 9, 2023

Severity

Critical

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-qv2g-99x4-45x6

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.