ThinkFacility Sign in
  1. Home
  2. Security
  3. npm package (electron)
Highnpm package (electron)

Electron before 42.11.16, 43.8.1 and 44.9.1: trusts compromised eMudhra certificates, update and rebuild

Developers who ship desktop apps built on Electron that connect to anything over a network.

How to fix it

You haveUpdate to
45.0.0-alpha.1 and later, before 45.0.0-beta.6→45.0.0-beta.644.0.0-alpha.1 and later, before 44.9.1→44.9.143.0.0-alpha.1 and later, before 43.8.1→43.8.1before 42.11.16→42.11.16

Check your version

Which version your project has
npm ls electron

Update

In your project
npm update electron
npm ls electron
Still old? A dependency pins it
npm explain electron
Then check what's left
npm audit

If you can't update yet

The Electron team says there's no workaround inside your app. You have to move to a fixed Electron version.

Browsers already block the compromised eMudhra intermediates. Older Electron builds still trust them, so someone holding one who can intercept your app's traffic could pose as the server it talks to. Apps that make no network connections aren't affected. If you only use an Electron app, update the app when its maker ships a fixed build.

If npm ls still shows an old version under another package, update that package, or add an "overrides" entry for this one in package.json.

Sources