Malicious Package in angular-location-update
Summary
GHSA-53jx-4wwh-gcqj: Malicious Package in angular-location-update. Affects angular-location-update versions 0.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The angular-location-update package is an npm package used in Angular applications to update the location of the browser. It provides functionality to extract and update the URL parameters of the current page. This package is vulnerable to a malicious code injection in version 0.0.3.
Vulnerability Detail
Version 0.0.3 of angular-location-update contained malicious code that, when executed in the browser, would enumerate password, cvc, and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=. This code poses a significant security risk as it can potentially compromise user data by extracting sensitive information.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to remove the angular-location-update package from your environment. Additionally, it is crucial to evaluate your application to determine whether any user data has been compromised. Users may also consider downgrading to version 0.0.2 of the package.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The angular-location-update package version 0.0.3 contains malicious code that can compromise user data. It is crucial to remove the package, evaluate your application for potential data compromise, and consider downgrading to version 0.0.2. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for angular-location-update →
FAQ
This vulnerability can lead to the extraction of sensitive user data, including passwords and credit card information, which can be used for malicious purposes.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file to analyze your dependencies.
Yes, the recommended fix is to remove the angular-location-update package from your environment and evaluate your application for any potential data compromise. Downgrading to version 0.0.2 is also an option.
There are no known workarounds for this vulnerability. Removing the package and evaluating your application are the recommended actions.
To prevent similar vulnerabilities, it is essential to regularly update your packages to the latest secure versions. Additionally, consider using a vulnerability monitoring tool like Vulert to receive real-time alerts for open-source vulnerabilities.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.