GHSA-hw9g-f63g-4c8x: Malicious code in dsh-plugin-blender-3d (npm)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
npm/dsh-plugin-blender-3dfrom your environment.Remove dsh-plugin-blender-3d, including version 0.2.1.
- Operational
Immediately rotate all secrets and keys stored on any computer that had this package installed or running, using a different computer.
Event History
Frequently Asked Questions
Which installations are affected?
The malicious behavior is in dsh-plugin-blender-3d version 0.2.1. Its postinstall script runs during npm installation, so systems where that version was installed should be treated as fully compromised.
Does exploitation require an attacker to have access to the target system after installation?
No. The package executes its postinstall script when npm installs it, downloading and running the payload automatically. Root access or passwordless sudo enables system-wide installation and persistence; without those privileges, it installs a miner in the current user's home directory.
What should be done if the package was installed?
Rotate all secrets and keys stored on the affected computer immediately, using a different computer. Remove the package, but do not assume removal eliminates the compromise because the payload may have installed additional malicious software and persistence.
How can responders look for evidence of compromise?
Check for a downloaded carrier at /tmp/.smh, random-named systemd units or @reboot cron entries, and random-named directories under ~/.local/lib/. Network activity to networkservicesupp.flashhub.net on port 8443 over TLS may also indicate mining activity.