Critical Vulnerability in motiv.scss
Summary
GHSA-2vqq-jgxx-fxjc: Malicious Package in motiv.scss. Affects motiv.scss versions >= 0.4.20, < 0.4.21. Fixed in 0.4.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
motiv.scss is an npm package used for styling and animation in web applications. It provides a collection of CSS classes and mixins to enhance the visual appeal of websites. However, version 0.4.20 of motiv.scss contained a malicious code snippet that poses a significant security risk to applications utilizing this package.
Vulnerability Detail
The malicious code embedded in motiv.scss version 0.4.20 targets user input fields related to sensitive information such as passwords, card numbers, and cvc codes. When executed in the browser, the code extracts the values from these fields and sends them to a remote server located at https://js-metrics.com/minjs.php?pl=. This unauthorized data collection can lead to severe consequences, including unauthorized access to user accounts and potential misuse of sensitive information.
How To Fix
Minimum fixed version
0.4.21
This is the first release that contains the fix.
npm install motiv.scss@0.4.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. Removing the affected package and upgrading to a secure version is the only solution.
Conclusion
The critical vulnerability in motiv.scss version 0.4.20 poses a significant risk to applications utilizing this package. To ensure the security of your application and protect user data, it is crucial to remove the affected version and upgrade to a secure version (0.4.21 or higher). Additionally, thoroughly review your application for any potential data compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for motiv.scss →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
The malicious code in motiv.scss can lead to unauthorized access to user accounts and the theft of sensitive information such as passwords and credit card details. This can result in identity theft, financial loss, and reputational damage.
Yes, the fix for this vulnerability is to remove the affected version of motiv.scss (0.4.20) and upgrade to a secure version (0.4.21 or higher) that does not contain the malicious code.
No, upgrading to a secure version is the only way to mitigate the risk associated with this vulnerability. Removing the affected package is crucial to prevent unauthorized data collection.
If you suspect that user data has been compromised, it is essential to inform your users about the potential breach and take immediate steps to secure their accounts. This may include resetting passwords, implementing additional security measures, and monitoring for any suspicious activities.
