GHSA-377f-vvrc-9wgg

Suggest an improvement
Source
https://github.com/advisories/GHSA-377f-vvrc-9wgg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-377f-vvrc-9wgg/GHSA-377f-vvrc-9wgg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-377f-vvrc-9wgg
Published
2020-09-03T19:09:07Z
Modified
2021-09-30T20:07:38Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Malicious Package in zemen
Details

Version 0.0.5 of zemen contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=

Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Database specific 
{
    "cwe_ids": [
        "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:47:17Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
}
References

Affected packages

npm / zemen

Package

Name
zemen
View open source insights on deps.dev
Purl
pkg:npm/zemen

Affected ranges

Type
SEMVER
Events
Introduced
0.0.5
Fixed
0.0.6

Affected versions

0.*
0.0.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-377f-vvrc-9wgg/GHSA-377f-vvrc-9wgg.json"