Malicious Package in css_transform_support
Summary
GHSA-45cp-hpc9-8347: Malicious Package in css_transform_support. Affects css_transform_support versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The css_transform_support package is an npm package that provides support for CSS transform properties in various web browsers. It allows developers to check if a particular browser supports CSS transform properties and provides a fallback mechanism for unsupported browsers. This package is widely used in web development projects to ensure cross-browser compatibility for CSS transformations.
Vulnerability Detail
Version 1.0.2 of css_transform_support contained malicious code. The code, when executed in the browser, would enumerate password, cvc, cardnumber fields from forms and send the extracted values to a remote server. This vulnerability poses a significant risk to user data as sensitive information can be captured and potentially misused. The malicious code was discovered and reported on September 1, 2020.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the recommended steps for fixing the vulnerability.
Conclusion
The css_transform_support package version 1.0.2 contains malicious code that can compromise user data. It is essential to take immediate action by replacing the affected version and evaluating the application for any potential data compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for css_transform_support →
FAQ
This vulnerability allows an attacker to capture sensitive user data, such as passwords and credit card information, from forms on affected websites.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any known vulnerabilities.
Yes, replacing version 1.0.2 of css_transform_support with a version before or after 1.0.2 will fix the vulnerability. It is also recommended to evaluate the application for any potential data compromise.
Yes, downgrading to version 1.0.1 is a valid option to mitigate the risk immediately. However, it is still recommended to evaluate the application for any potential data compromise.
If version 1.0.2 of css_transform_support is found installed in your project, it is crucial to replace it with a version before or after 1.0.2. Additionally, evaluate your application for any potential data compromise.
