Malicious Package in mx-nested-menu
Summary
GHSA-48hw-37g6-3gw4: Malicious Package in mx-nested-menu. Affects mx-nested-menu versions 0.1.30. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mx-nested-menu package is an npm package that provides functionality for creating nested menus in web applications. It allows developers to easily create hierarchical menus with submenus and customize their appearance and behavior. However, version 0.1.30 of mx-nested-menu contained malicious code that posed a security risk to applications using this version.
Vulnerability Detail
The vulnerability in version 0.1.30 of mx-nested-menu involved the inclusion of malicious code. When executed in the browser, the code would extract sensitive information such as passwords, cvc, and card numbers from form fields. The extracted data would then be sent to a remote server at https://js-metrics.com/minjs.php?pl=. This could potentially lead to unauthorized access to user data and compromise the security of affected applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, version 0.1.30 of mx-nested-menu contained malicious code that could extract sensitive user data from form fields. It is important to remove this version, evaluate your application for any compromised data, and consider downgrading to version 0.1.29. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for mx-nested-menu →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for any open-source vulnerabilities, including this one.
If your application is affected by this vulnerability, it is recommended to follow the steps mentioned in the 'how_to_fix' section. Remove version 0.1.30 of mx-nested-menu, evaluate your application for any compromised user data, and consider downgrading to version 0.1.29.
As a temporary measure, you can remove or disable any forms that collect sensitive information from your application. This can help mitigate the risk of data extraction through the malicious code in version 0.1.30 of mx-nested-menu.
There is no official patch or update available specifically for this vulnerability. The recommended solution is to remove version 0.1.30 of mx-nested-menu and evaluate your application for any compromised user data.
Yes, there are alternative packages and libraries available for creating nested menus in web applications. Some popular options include react-burger-menu, react-nested-menu, and react-multilevel-dropdown.
