Malicious Package in awesome_react_utility
Summary
GHSA-m25q-fwg4-9v2p: Malicious Package in awesome_react_utility. Affects awesome_react_utility versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The awesome_react_utility package is an npm package that provides utility functions for React applications. It is commonly used to enhance the development process by providing convenient methods for handling common tasks in React projects. However, version 1.0.2 of this package has been found to contain malicious code.
Vulnerability Detail
The vulnerability in version 1.0.2 of awesome_react_utility is due to the presence of malicious code. When executed in the browser, this code enumerates password, cvc, and card number fields from forms and sends the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This poses a significant security risk as it can lead to the compromise of sensitive user data, including passwords and credit card information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to a non-vulnerable version of the package as soon as possible.
Conclusion
In conclusion, version 1.0.2 of awesome_react_utility contains malicious code that can compromise sensitive user data. It is highly recommended to update to a non-vulnerable version of the package and evaluate your application for any potential data breaches. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for awesome_react_utility →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the package-lock.json file of your project, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
The potential consequences of this vulnerability include the unauthorized extraction of sensitive user data, such as passwords and credit card information, from forms in the browser. This can lead to identity theft, financial loss, and other security breaches.
Yes, versions of awesome_react_utility before and after 1.0.2 are considered safe and not affected by this vulnerability. It is recommended to update to a non-vulnerable version to ensure the security of your application.
While implementing additional security measures can help improve overall application security, they cannot fully mitigate the risk posed by this vulnerability. The best course of action is to update to a non-vulnerable version of awesome_react_utility as soon as possible.
Yes, the malicious code has been removed in versions of awesome_react_utility after 1.0.2. It is crucial to update to a non-vulnerable version to ensure the security of your application.
