GHSA-56r9-v65c-34jm

Suggest an improvement
Source
https://github.com/advisories/GHSA-56r9-v65c-34jm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-56r9-v65c-34jm/GHSA-56r9-v65c-34jm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-56r9-v65c-34jm
Published
2020-09-03T02:33:37Z
Modified
2023-07-13T21:05:58Z
Summary
Malicious Package in radicjs
Details

Version 0.2.1 of radicjs contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=

Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised. Users may downgrade to 0.2.0

Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:41:24Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}
References

Affected packages

npm / radicjs

Package

Name
radicjs
View open source insights on deps.dev
Purl
pkg:npm/radicjs

Affected ranges

Affected versions

0.*
0.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-56r9-v65c-34jm/GHSA-56r9-v65c-34jm.json"