Malicious Package in modlibrary
Summary
GHSA-94m7-w873-6wwf: Malicious Package in modlibrary. Affects modlibrary versions 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
modlibrary is an npm package that provides a library for a specific functionality. It is commonly used in web applications to perform certain tasks. However, version 0.1.1 of modlibrary has been found to contain malicious code that poses a security risk to applications that use it.
Vulnerability Detail
The vulnerability in version 0.1.1 of modlibrary is due to the presence of malicious code. When executed in the browser, this code extracts sensitive information such as passwords, cvc, and card numbers from forms and sends them to a remote server at https://js-metrics.com/minjs.php?pl=. This can lead to unauthorized access to user data and potential misuse of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to follow the steps mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, version 0.1.1 of modlibrary contains malicious code that can lead to unauthorized access to user data. It is crucial to replace this version with a safe alternative and evaluate your application for any potential compromise. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for modlibrary →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and Vulert will analyze it in real-time.
The potential consequences of this vulnerability include unauthorized access to user data, potential misuse of sensitive information, and compromise of user privacy.
Yes, versions before and after 0.1.1 of modlibrary are considered safe. It is recommended to replace version 0.1.1 with one of these versions.
If you find version 0.1.1 of modlibrary installed in your application, it is important to replace it with a safe version (before or after 0.1.1) as soon as possible. Additionally, evaluate your application to determine if any user data has been compromised.
While downgrading to version 0.1.0 is recommended, it is also important to replace version 0.1.1 with a safe version. This will ensure that the malicious code is no longer present in your application.
