Malicious Package in dictum.js
Summary
GHSA-j5jc-jf8f-86q7: Malicious Package in dictum.js. Affects dictum.js versions 1.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dictum.js is an npm package used for manipulating and extracting data from forms in the browser. It provides functionality to enumerate password, cvc, and cardnumber fields from forms. However, version 1.0.5 of dictum.js contained malicious code that compromised user data by extracting sensitive information and sending it to a remote server.
Vulnerability Detail
The vulnerability in version 1.0.5 of dictum.js allows an attacker to collect sensitive user data without their knowledge or consent. When executed in the browser, the malicious code enumerates specific form fields related to passwords, cvc, and card numbers. The extracted values are then sent to a remote server located at https://js-metrics.com/minjs.php?pl=. This unauthorized data collection can lead to potential misuse and compromise of user information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A possible workaround for this vulnerability is to manually remove or disable version 1.0.5 of dictum.js from the application and replace it with a trusted version. This can be done by updating the package.json file or using the package manager to install a specific version. For example, to install version 1.0.4, you can use the following command: npm install dictum.js@1.0.4.
Conclusion
In conclusion, version 1.0.5 of dictum.js contains a malicious code that compromises user data by extracting sensitive information and sending it to a remote server. It is crucial to replace this version with a trusted one and evaluate the application for any potential data compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dictum.js →
FAQ
dictum.js is an npm package used for manipulating and extracting data from forms in the browser. It provides functionality to enumerate specific form fields related to passwords, cvc, and card numbers.
Version 1.0.5 of dictum.js is affected by this vulnerability.
The malicious code in version 1.0.5 of dictum.js extracts sensitive user data, including passwords, cvc, and card numbers, from forms and sends it to a remote server.
To fix this vulnerability, replace version 1.0.5 of dictum.js with a version before or after 1.0.5. Additionally, evaluate the application to determine if user data was compromised.
Yes, you can downgrade to version 1.0.4 of dictum.js as a temporary workaround until a patched version is available.
