Malicious Package in another-date-range-picker
Summary
GHSA-8rxg-9g6f-vq9p: Malicious Package in another-date-range-picker. Affects another-date-range-picker versions 4.1.48. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The another-date-range-picker package is an npm package used for date range picking in web applications. It provides a user-friendly interface for selecting date ranges and is commonly used in various projects. However, version 4.1.48 of this package contained malicious code that posed a security risk to applications using it.
Vulnerability Detail
The vulnerability in version 4.1.48 of another-date-range-picker was due to the presence of malicious code. When executed in the browser, this code would extract sensitive information such as passwords, cvc, and card numbers from forms and send them to a remote server at https://js-metrics.com/minjs.php?pl=. This could potentially lead to the compromise of user data and pose a significant security threat to affected applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to update to a secure version of another-date-range-picker and assess the impact on user data.
Conclusion
In conclusion, version 4.1.48 of another-date-range-picker contained malicious code that could compromise user data. It is crucial to update to a secure version, evaluate the impact on user data, and take appropriate actions to address any potential compromise. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for another-date-range-picker →
FAQ
another-date-range-picker is an npm package used for selecting date ranges in web applications. It provides a user-friendly interface and is widely used in various projects.
The malicious code in version 4.1.48 of another-date-range-picker could extract sensitive information from forms, including passwords, cvc, and card numbers. This could lead to the compromise of user data.
To fix this vulnerability, you should replace version 4.1.48 of another-date-range-picker with a secure version. Additionally, evaluate your application for any potential data compromise and take appropriate actions.
No specific workarounds are mentioned for this vulnerability. Updating to a secure version is the recommended solution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
