Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/ua-parser-js@0.7.29
Typenpm
Namespace
Nameua-parser-js
Version0.7.29
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.7.33
Latest_non_vulnerable_version1.0.33
Affected_by_vulnerabilities
0
url VCID-uqy7-83dp-37gd
vulnerability_id VCID-uqy7-83dp-37gd
summary 
Embedded malware in ua-parser-js
The npm package `ua-parser-js` had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See [this issue](https://github.com/faisalman/ua-parser-js/issues/536) for details as they unfold.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
references
0
reference_url https://github.com/faisalman/ua-parser-js
reference_id
reference_type
scores
url https://github.com/faisalman/ua-parser-js
1
reference_url https://github.com/faisalman/ua-parser-js/issues/536
reference_id
reference_type
scores
url https://github.com/faisalman/ua-parser-js/issues/536
2
reference_url https://github.com/faisalman/ua-parser-js/issues/536#issuecomment-949772496
reference_id
reference_type
scores
url https://github.com/faisalman/ua-parser-js/issues/536#issuecomment-949772496
3
reference_url https://us-cert.cisa.gov/ncas/current-activity/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js
reference_id
reference_type
scores
url https://us-cert.cisa.gov/ncas/current-activity/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js
4
reference_url https://www.npmjs.com/package/ua-parser-js
reference_id
reference_type
scores
url https://www.npmjs.com/package/ua-parser-js
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-4229
reference_id CVE-2021-4229
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2021-4229
6
reference_url https://github.com/advisories/GHSA-pjwm-rvh2-c87w
reference_id GHSA-pjwm-rvh2-c87w
reference_type
scores
url https://github.com/advisories/GHSA-pjwm-rvh2-c87w
fixed_packages
0
url pkg:npm/ua-parser-js@0.7.30
purl pkg:npm/ua-parser-js@0.7.30
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5rba-b2bd-nfgv
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@0.7.30
1
url pkg:npm/ua-parser-js@0.8.1
purl pkg:npm/ua-parser-js@0.8.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@0.8.1
2
url pkg:npm/ua-parser-js@1.0.1
purl pkg:npm/ua-parser-js@1.0.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@1.0.1
aliases CVE-2021-4229, GHSA-pjwm-rvh2-c87w, GMS-2021-1
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uqy7-83dp-37gd
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@0.7.29