Malicious Package in bmap - Critical Vulnerability
Summary
GHSA-p59g-6cqr-m73w: Malicious Package in bmap. Affects bmap versions 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The bmap package is an npm package used for mapping and geocoding in JavaScript applications. It provides functionality to convert addresses into coordinates and vice versa. The package is widely used in various web applications to integrate location-based services. However, version 1.0.3 of the bmap package has been found to contain malicious code.
Vulnerability Detail
The vulnerability in version 1.0.3 of bmap is due to the presence of malicious code. When executed in a browser, the code extracts sensitive information such as passwords, cvc, and card numbers from form fields. It then sends the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This unauthorized data collection can lead to severe consequences, including potential compromise of user data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The bmap package version 1.0.3 contains a critical vulnerability that allows unauthorized extraction of sensitive user information. It is recommended to replace this version with a secure alternative and evaluate the application for potential data compromise. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bmap →
FAQ
The impact of this vulnerability can be severe, as it allows unauthorized extraction of sensitive user information from form fields.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes the package-lock.json file and provides real-time alerts for open-source vulnerabilities.
Yes, versions of bmap before and after 1.0.3 are considered safe. It is recommended to replace version 1.0.3 with a secure version.
If user data has been compromised, it is essential to take immediate action. This includes notifying affected users, implementing necessary security measures, and potentially involving legal authorities depending on the severity of the breach.
To prevent similar vulnerabilities, it is crucial to regularly update packages to their latest secure versions, perform security audits, and implement secure coding practices. Additionally, using tools like Vulert can help in identifying and addressing vulnerabilities in real-time.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
