Skip to main content

Update this NPM package now, millions of devs told

Glasses in front of computer screen
(Image credit: Kevin Ku / Pexels)

Cybersecurity researchers have found a high-severity remote code execution (RCE) vulnerability inside a widely used NPM package named Pac-Resolver.

According to researcher Tim Perry who found the flaw, PAC stands for Proxy Auto-Config, which are scripts written in JavaScript that help HTTP clients select the right proxy for a given hostname, using dynamic logic.

“This package is used for PAC file support in Pac-Proxy-Agent, which is used in turn in Proxy-Agent, which then used all over the place as the standard go-to package for HTTP proxy autodetection & configuration in Node.js. It's very popular,” writes Perry. 

He adds that Proxy-Agent clocks about three million downloads per week, and exists in 285,000 public dependent repos on GitHub.

Affects countless apps

In his post, Perry explains that the vulnerability, tracked as CVE-2021-23406, could enable bad actors to remotely run arbitrary code on your computer whenever you send an HTTP request.

Further explaining the conditions that make Node.js apps prone to exploitation, Perry says the vulnerability affects all Pac-Resolver users who explicitly use PAC files for proxy configuration, or read and use the operating system proxy configuration on systems that use the WPAD protocol, or use proxy configuration from an untrusted source.

In a way, Perry believes the vulnerability affects anyone who uses the Pac-Resolver package in their apps. 

“If you're in this situation, you need to update (to Pac-Resolver v5 and/or Proxy-Agent v5) right now,” suggests Perry.

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.