Malicious Package in json-serializer
Summary
GHSA-7xfq-xh6v-4mrm: Malicious Package in json-serializer. Affects json-serializer versions >= 2.0.10, < 2.0.11. Fixed in 2.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-serializer package is an npm package used for serializing and deserializing JSON data. It provides a convenient way to convert JavaScript objects to JSON strings and vice versa. The package is widely used in web applications to handle data serialization. However, version 2.0.10 of the package contained malicious code that could compromise user data.
Vulnerability Detail
The vulnerability in version 2.0.10 of json-serializer is due to the presence of malicious code. When executed in the browser, the code would extract sensitive information such as passwords, cvc, and card numbers from form fields. It then sends the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This could lead to unauthorized access to user data and potential misuse of sensitive information.
How To Fix
Latest published version: 2.0.12 as of 23 Oct 2026
npm install json-serializer@2.0.12Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.11
This is the first release that contains the fix.
npm install json-serializer@2.0.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the recommended fix and update the package to a non-vulnerable version.
Conclusion
The json-serializer package version 2.0.10 contained malicious code that could extract sensitive information from form fields in the browser. It is recommended to update the package to a non-vulnerable version and evaluate the application for any potential data compromise. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for json-serializer →
FAQ
The vulnerability allows an attacker to extract sensitive information from form fields in the browser, potentially compromising user data.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no specific known exploits mentioned for this vulnerability. However, the presence of the malicious code in version 2.0.10 of json-serializer indicates that it could be potentially exploited by attackers.
Yes, a fix is available for this vulnerability. It involves updating the json-serializer package to a version before or after 2.0.10.
If user data was compromised, it is important to take appropriate actions to mitigate the impact. This may include notifying affected users, resetting passwords, and implementing additional security measures to prevent further unauthorized access.
References
Related vulnerabilities
Recent vulnerabilities recorded for json-serializer.
