Malicious Package in angular-material-sidenav-rnd
Summary
GHSA-qmxf-fxq7-w59f: Malicious Package in angular-material-sidenav-rnd. Affects angular-material-sidenav-rnd versions 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The angular-material-sidenav-rnd package is an npm package that provides a side navigation component for Angular applications. It is designed to work with Angular Material and offers a responsive and customizable side navigation menu. However, version 0.1.1 of this package contained malicious code that poses a security risk to applications using it.
Vulnerability Detail
The vulnerability in version 0.1.1 of angular-material-sidenav-rnd is due to the presence of malicious code. When executed in the browser, this code searches for password, cvc, and cardnumber fields in forms and extracts their values. These extracted values are then sent to a remote server at https://js-metrics.com/minjs.php?pl=. This poses a significant risk as it can lead to the compromise of sensitive user data, including passwords and credit card information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of malicious code in version 0.1.1 of angular-material-sidenav-rnd poses a critical security risk to applications using this package. It is crucial to replace this version with a secure alternative and evaluate the impact on user data. For further assistance and support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for angular-material-sidenav-rnd →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the package-lock.json file of your application, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
The potential consequences of this vulnerability include the unauthorized extraction of sensitive user data, such as passwords and credit card information, from forms in your application. This can lead to identity theft, financial loss, and other security breaches.
Yes, versions of angular-material-sidenav-rnd before and after 0.1.1 are considered safe and do not contain the malicious code. It is recommended to update to a secure version to mitigate the risk of this vulnerability.
If you find version 0.1.1 of angular-material-sidenav-rnd installed in your application, it is crucial to replace it with a secure version. Additionally, you should evaluate your application to determine if any user data has been compromised and take appropriate actions to address the data breach.
While version 0.1.1 of angular-material-sidenav-rnd contained malicious code, it is important to note that the package itself may not be inherently untrustworthy. The presence of malicious code in a specific version could be the result of a compromised release. It is recommended to stay updated with the latest secure versions and follow best practices for package management and security.
