Malicious Package in freshdom
Summary
GHSA-8qm2-24qc-c4qg: Malicious Package in freshdom. Affects freshdom versions 0.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
freshdom is an npm package that provides functionality for working with forms in the browser. It allows developers to manipulate form elements and extract data from them. However, version 0.0.6 of freshdom contained malicious code that could compromise user data.
Vulnerability Detail
The vulnerability in freshdom version 0.0.6 involved the inclusion of malicious code. When executed in the browser, this code would search for password, cvc, and cardnumber fields in forms and extract the values entered by users. The extracted data was then sent to a remote server at https://js-metrics.com/minjs.php?pl=. This unauthorized data collection could lead to the compromise of sensitive user information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
Version 0.0.6 of freshdom contained malicious code that could compromise user data by extracting sensitive information from form fields. It is crucial to replace this version with a safe alternative and assess the impact on user data. For further assistance and guidance on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for freshdom →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this specific vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using the package-lock.json file, without requiring access to the code or installation.
If your application is affected by this vulnerability, you should immediately replace version 0.0.6 of freshdom with a safe version. Additionally, you should assess the potential impact on user data and take appropriate measures to mitigate any compromised information.
There are no known exploits of this specific vulnerability at the moment. However, it is crucial to address the issue promptly to prevent any potential data breaches or unauthorized access to user information.
There is no known workaround for this vulnerability. The best course of action is to update the freshdom package to a safe version and evaluate the impact on user data.
For further support on vulnerability remediation and assistance in securing your application, you can reach out to info@devnack.com. They can provide guidance and help ensure your application is protected against this and other vulnerabilities.
