Malicious Package in leaflet-gpx
Summary
GHSA-gjc9-932x-c59p: Malicious Package in leaflet-gpx. Affects leaflet-gpx versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The leaflet-gpx package is an npm package that provides functionality for displaying GPX tracks on a Leaflet map. It allows users to load GPX files and visualize them on a map. The package is widely used in web applications that involve displaying GPS tracks or routes. However, version 1.0.1 of the package contained malicious code that could compromise user data.
Vulnerability Detail
The vulnerability in version 1.0.1 of leaflet-gpx arises from the presence of malicious code. When executed in the browser, the code would extract sensitive information such as passwords, cvc, and card numbers from form fields. It then sends the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This can lead to unauthorized access to user data and potential misuse of sensitive information. The malicious code poses a significant security risk to applications that have integrated version 1.0.1 of leaflet-gpx.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the recommended steps for fixing the vulnerability.
Conclusion
In conclusion, version 1.0.1 of leaflet-gpx contained malicious code that could compromise user data. It is crucial to remove this version from your environment and evaluate the impact on your application. Downgrading to version 1.0.0 is recommended. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for leaflet-gpx →
FAQ
leaflet-gpx is an npm package used for displaying GPX tracks on a Leaflet map.
The malicious code can extract sensitive information from form fields and send it to a remote server, potentially leading to unauthorized access and misuse of user data.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file to the playground.
Yes, version 1.0.0 of leaflet-gpx is considered safe and does not contain the malicious code.
If your application is affected, you should remove version 1.0.1 of leaflet-gpx, evaluate the impact on user data, take appropriate measures to mitigate the breach, and consider downgrading to version 1.0.0.
