GHSA-4j54-mmmv-hjpm

Source

https://github.com/advisories/GHSA-4j54-mmmv-hjpm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4j54-mmmv-hjpm/GHSA-4j54-mmmv-hjpm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4j54-mmmv-hjpm

Published

2020-09-03T19:17:51Z

Modified

2023-07-27T20:05:27Z

Summary

Malicious Package in slush-fullstack-framework

Details

Version 0.9.2 of slush-fullstack-framework contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=

Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.9.1

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:47:33Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

https://www.npmjs.com/advisories/1108

Affected packages

npm / slush-fullstack-framework

Package

Name: slush-fullstack-framework; View open source insights on deps.dev
Purl: pkg:npm/slush-fullstack-framework

Affected ranges

Affected versions

0.*

0.9.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4j54-mmmv-hjpm/GHSA-4j54-mmmv-hjpm.json"