Malicious Package in css_transform_step
Summary
GHSA-4rx9-58m7-gr8w: Malicious Package in css_transform_step. Affects css_transform_step versions 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The css_transform_step package is an npm package used for manipulating CSS transform values. It provides functions for creating and manipulating CSS transform steps. The package is commonly used in web development projects to apply transformations to HTML elements.
However, version 1.0.6 of the css_transform_step package contained malicious code. When executed in the browser, this code would extract sensitive information such as passwords, cvc codes, and card numbers from form fields. The extracted data would then be sent to a remote server at https://js-metrics.com/minjs.php?pl=.
Vulnerability Detail
The vulnerability in version 1.0.6 of css_transform_step allows an attacker to collect sensitive user data without their knowledge or consent. By injecting malicious code into the package, the attacker can intercept and exfiltrate information entered into password, cvc, and card number fields on affected websites. This poses a significant risk to user privacy and can lead to identity theft or unauthorized access to sensitive accounts.
The malicious code in version 1.0.6 of css_transform_step was discovered and reported on September 1, 2020. It is important to note that this vulnerability only affects version 1.0.6 of the package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The css_transform_step package version 1.0.6 contains malicious code that can extract sensitive user data from affected websites. To mitigate this vulnerability, it is crucial to replace version 1.0.6 with a safe version and evaluate the application for any compromised user data. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for css_transform_step →
FAQ
css_transform_step is an npm package used for manipulating CSS transform values. It provides functions for creating and manipulating CSS transform steps in web development projects.
The vulnerability allows an attacker to extract sensitive user data, such as passwords and card numbers, from affected websites.
Only version 1.0.6 of css_transform_step is affected by this vulnerability.
To fix this vulnerability, replace version 1.0.6 of css_transform_step with a version before or after 1.0.6. Additionally, evaluate the application for any compromised user data and take appropriate measures.
There is no known workaround for this vulnerability. It is recommended to update the package to a safe version.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
