Malicious Package in coffee-project
Summary
GHSA-3fv6-q5xv-fhpw: Malicious Package in coffee-project. Affects coffee-project versions 1.7.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The coffee-project is an npm package that provides functionality related to coffee. It is commonly used in web applications to handle coffee-related tasks. The package is vulnerable to a malicious code injection in version 1.7.5.
Vulnerability Detail
Version 1.7.5 of coffee-project contained malicious code that, when executed in the browser, would extract sensitive information such as passwords, cvc, and card numbers from forms. The extracted values were then sent to a remote server at https://js-metrics.com/minjs.php?pl=. This vulnerability poses a significant risk to user data and privacy.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A temporary workaround for this vulnerability is to downgrade the coffee-project package to version 1.7.4. This can be done by modifying the package.json file and running the npm install command. Here is an example:
"dependencies": {
"coffee-project": "1.7.4"
}
After making the changes, run the following command:
npm install
Conclusion
The coffee-project package version 1.7.5 contains a critical vulnerability that allows for the extraction of sensitive information from forms in the browser. It is recommended to replace this version with a safe alternative and evaluate the application for any compromised user data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for coffee-project →
FAQ
This vulnerability allows an attacker to extract sensitive information from forms in the browser, potentially compromising user data and privacy.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities.
Yes, replacing the installed coffee-project package with a version before or after 1.7.5 will permanently fix this vulnerability. It is also important to evaluate the application for any compromised user data.
While downgrading to version 1.7.4 is the recommended workaround, you can also consider implementing additional security measures such as input validation and sanitization to minimize the risk of data extraction.
There are no known specific exploits of this vulnerability at the moment. However, it is crucial to address this issue promptly to prevent any potential data breaches or unauthorized access.
