Malicious Package in codify - Critical Vulnerability
Summary
GHSA-2q6w-rxf3-4wc9: Malicious Package in codify. Affects codify versions 0.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The codify package is an npm package used for a specific functionality. It is vulnerable to a critical security issue in version 0.3.1. This package contained malicious code that, when executed in the browser, would extract sensitive information such as passwords, cvc, and card numbers from forms. The extracted data was then sent to a malicious server at https://js-metrics.com/minjs.php?pl=. This vulnerability poses a significant risk to user data and privacy.
Vulnerability Detail
The vulnerability in version 0.3.1 of codify arises from the inclusion of malicious code. When this version is installed and executed in the browser, it actively searches for password, cvc, and card number fields in forms. It then sends the extracted values to a remote server controlled by attackers. This can lead to unauthorized access to sensitive user information, potentially resulting in identity theft, financial fraud, or other malicious activities. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the recommended steps for fixing the vulnerability, which involve replacing the affected version of the codify package and evaluating the application for potential data compromise.
Conclusion
The codify package version 0.3.1 contains a critical vulnerability that allows for the extraction of sensitive user information and potential unauthorized access. It is crucial to replace this version with a secure alternative and evaluate the application for any compromised data. Regularly updating packages, monitoring for vulnerabilities, and following best practices are essential for maintaining the security of your application.
See every vulnerability recorded for codify →
FAQ
This vulnerability can lead to unauthorized access to sensitive user information, potentially resulting in identity theft, financial fraud, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
If your application is affected, it is recommended to replace the installed codify package with a version before or after 0.3.1. Additionally, evaluate your application for potential data compromise and take necessary steps to secure user information.
Regularly updating packages, keeping track of security advisories, and following best practices for secure coding can help prevent such vulnerabilities in the future. It is also advisable to use tools like Vulert to monitor and alert for open-source vulnerabilities in real-time.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing the vulnerability and securing your application.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
