Malicious Package in @fangrong/xoc
Summary
GHSA-pjxp-f379-6284: Malicious Package in @fangrong/xoc. Affects @fangrong/xoc versions 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @fangrong/xoc package is an npm package that provides functionality for extracting data from forms in a browser. It is commonly used in web applications to retrieve user input from HTML forms. However, version 1.0.6 of this package contained malicious code that could compromise user data.
Vulnerability Detail
The vulnerability in version 1.0.6 of @fangrong/xoc arises from the presence of malicious code. When executed in the browser, this code would extract sensitive information such as passwords, cvc, and card numbers from forms. The extracted data would then be sent to a remote server at https://js-metrics.com/minjs.php?pl=. This poses a significant risk to user privacy and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the @fangrong/xoc package version 1.0.6 contains malicious code that can extract sensitive user data from forms in a web application. It is recommended to remove the package, evaluate your application for any compromised data, and consider downgrading to version 1.0.5. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @fangrong/xoc →
FAQ
@fangrong/xoc is an npm package used for extracting data from HTML forms in a browser.
The vulnerability allows an attacker to extract sensitive user data, such as passwords and credit card information, from forms in a web application.
To fix this vulnerability, remove the @fangrong/xoc package from your environment and evaluate your application for any compromised user data. Consider downgrading to version 1.0.5 if you are currently using version 1.0.6.
There is no known workaround for this vulnerability. Removing the package and evaluating your application are the recommended steps.
Yes, you can continue using @fangrong/xoc, but it is crucial to ensure that you are using a version that is not affected by this vulnerability. Downgrading to version 1.0.5 is recommended.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
