Malicious Package in another-date-picker
Summary
GHSA-2p62-c4rm-mr72: Malicious Package in another-date-picker. Affects another-date-picker versions >= 2.0.43, < 2.0.45. Fixed in 2.0.45. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The another-date-picker package is an npm package used for date picking functionality in web applications. It provides a user-friendly interface for selecting dates and is commonly used in form inputs. However, version 2.0.43 of this package contained malicious code that posed a security risk to applications using it.
Vulnerability Detail
The vulnerability in version 2.0.43 of another-date-picker was due to the presence of malicious code. When executed in the browser, this code would extract sensitive information such as passwords, cvc, and card numbers from form fields. The extracted data was then sent to a remote server at https://js-metrics.com/minjs.php?pl=. This unauthorized data collection could lead to the compromise of user information and potential misuse by malicious actors.
How To Fix
Minimum fixed version
2.0.45
This is the first release that contains the fix.
npm install another-date-picker@2.0.45Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The presence of malicious code in version 2.0.43 of another-date-picker poses a critical security risk to applications using this package. It is crucial to update to a safe version, evaluate the impact on user data, and take necessary actions to mitigate any potential breaches. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for another-date-picker →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
The potential consequences of this vulnerability include the unauthorized extraction of sensitive user data, such as passwords and credit card information. This data can be misused by malicious actors for identity theft, financial fraud, or other malicious purposes.
No, there are no known workarounds for this vulnerability. The recommended solution is to update the another-date-picker package to a version before or after 2.0.43 and evaluate the impact on user data.
The advisory does not provide specific evidence of data breaches caused by this vulnerability. However, it is crucial to evaluate your application and assess if any user data was compromised to ensure appropriate actions are taken.
To prevent such vulnerabilities in the future, it is essential to regularly update your application's dependencies and stay informed about security advisories for the packages you use. Additionally, consider implementing security measures such as input validation and sanitization to mitigate the risk of malicious code injection.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
