Malicious Package in grunt-radic
Summary
GHSA-9p49-cwh3-4qhf: Malicious Package in grunt-radic. Affects grunt-radic versions 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The grunt-radic package is an npm package used for task automation with Grunt. It provides a set of predefined tasks and configurations to streamline the development process. This package is vulnerable to a critical security issue in version 0.1.1.
Vulnerability Detail
Version 0.1.1 of grunt-radic contained malicious code. When executed in the browser, the code would enumerate password, cvc, and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=. This vulnerability poses a significant risk to user data as sensitive information can be captured and transmitted without consent.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A temporary workaround for this vulnerability is to downgrade the grunt-radic package to version 0.1.0. This can be achieved by modifying the package.json file and running the npm install command. Here is an example of how to downgrade the package:
"dependencies": {
"grunt-radic": "0.1.0"
}
After making the changes, run the following command:
npm install
Conclusion
The grunt-radic package version 0.1.1 contains a critical vulnerability that allows unauthorized capture and transmission of sensitive user data. It is recommended to remove the package from your environment and evaluate the impact on your application. Downgrading to version 0.1.0 can be considered as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for grunt-radic →
FAQ
This vulnerability allows an attacker to capture sensitive user data, including passwords and credit card information, without the user's knowledge or consent.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time.
The permanent fix for this vulnerability is to remove the grunt-radic package from your environment and ensure that no compromised data remains in your application.
At the time of this advisory, there is no newer version of grunt-radic available. It is recommended to remove the package until a secure version is released.
If user data has been compromised, it is essential to inform the affected users and take appropriate measures to mitigate the impact. This may include resetting passwords, monitoring for fraudulent activities, and notifying relevant authorities.
