Malicious Package in github-jquery-widgets
Summary
GHSA-c722-pv5w-cfg2: Malicious Package in github-jquery-widgets. Affects github-jquery-widgets versions 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The github-jquery-widgets package is an npm package that provides jQuery widgets for GitHub-related functionality. It allows developers to easily integrate GitHub features into their web applications. However, version 0.1.2 of this package contained malicious code that could compromise user data.
Vulnerability Detail
The vulnerability in version 0.1.2 of github-jquery-widgets is due to the presence of malicious code. When executed in the browser, this code would extract sensitive information such as passwords, cvc, and card numbers from form fields. The extracted data is then sent to a remote server at https://js-metrics.com/minjs.php?pl=. This poses a significant risk to user privacy and can lead to unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the recommended steps for fixing the issue.
Conclusion
Version 0.1.2 of the github-jquery-widgets package contained malicious code that could compromise user data. It is crucial to remove this package from your environment and evaluate your application for any potential data breaches. Downgrading to version 0.1.1 or considering alternative packages is recommended. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github-jquery-widgets →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
The potential consequences of this vulnerability include unauthorized access to sensitive user data, such as passwords and credit card information. This can lead to identity theft, financial loss, and other privacy breaches.
Yes, the recommended fix is to remove the github-jquery-widgets package from your environment and evaluate your application for any compromised user data. Downgrading to version 0.1.1 of the package is also an option.
Yes, there are alternative packages available that provide similar functionality to github-jquery-widgets. It is recommended to research and choose a package with a good security track record and active maintenance.
To prevent similar vulnerabilities in the future, it is important to regularly update your packages to the latest secure versions. Additionally, consider using a vulnerability monitoring tool like Vulert to receive real-time alerts for open-source vulnerabilities in your software.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
