https://github.com/faisalman/ua-parser-js/issues/536 – spotted and reported by @Majavah with further comment by @Urbanecm_WMF and @Legoktm in IRC.
Description
Description
Details
Details
- Risk Rating
- Low
- Author Affiliation
- WMF Product
Related Objects
Related Objects
Event Timeline
Comment Actions
The instances I see are related to the devtools dev dependency: 1, 2. So likely no Wikimedia production implications, but regular Wikibase/data-bridge developers should be cautious of any odd network traffic/CPU usage on their machines, remove or avoid installing webdriverio/devtools and (continue) use(ing) tools like fresh-node for at least a modicum of npm safety.
And analytics/pivot hasn't been used in years.
Comment Actions
Also the version pinned in package-lock.json was *not* vulnerable as far as we know. So only anyone trying to npm update would've been caught AIUI. The malware was also for Windows, further narrowing the set of people possibly affected.
Comment Actions
Given the above discussion, it appears this was a very limited security issue that likely did not affect us. We'll move this task to the Security-Team's frozen column and plan to make it public during our next Phab cleanup session in December.
Comment Actions
It seems that ua-parser-js is pulled in as a webdriver/wdio dependency:
shell output
$ npm why ua-parser-js ua-parser-js@1.0.2 dev node_modules/ua-parser-js ua-parser-js@"^1.0.1" from devtools@7.16.13 node_modules/devtools devtools@"7.16.13" from webdriverio@7.16.13 node_modules/webdriverio peer webdriverio@"^7.0" from wdio-wikibase@5.2.0 node_modules/wdio-wikibase dev wdio-wikibase@"^5.2.0" from the root project webdriverio@"7.16.13" from @wdio/cli@7.16.13 node_modules/@wdio/cli dev @wdio/cli@"^7.16.13" from the root project peer @wdio/cli@"^7.0.0" from @wdio/local-runner@7.16.13 node_modules/@wdio/local-runner dev @wdio/local-runner@"^7.16.13" from the root project peer @wdio/cli@"^7.0.0" from @wdio/spec-reporter@7.16.13 node_modules/@wdio/spec-reporter dev @wdio/spec-reporter@"^7.16.13" from the root project peer @wdio/cli@"^7.0.0" from @wdio/devtools-service@7.16.13 node_modules/@wdio/devtools-service dev @wdio/devtools-service@"^7.16.13" from the root project webdriverio@"7.16.13" from @wdio/runner@7.16.13 node_modules/@wdio/runner @wdio/runner@"7.16.13" from @wdio/local-runner@7.16.13 node_modules/@wdio/local-runner dev @wdio/local-runner@"^7.16.13" from the root project webdriverio@"7.16.13" from @wdio/devtools-service@7.16.13 node_modules/@wdio/devtools-service dev @wdio/devtools-service@"^7.16.13" from the root project
Currently, those browser tests are not running because they are still written in a sync way which is no longer compatible with node 16. So this issue should be resolved when the browser tests (and thus webdriver/wdio packages) are either updated to async or replaced by a different way of running end-to-end tests (say, Cypress).
Currently, there is only T293080: Refactor Wikibase WebdriverIO tests from sync to async mode, but I'll create a dedicated task for dealing with the Selenium Tests in Wikidata Bridge and will link this task there.