Malicious Package in ngx-context-menu
Summary
GHSA-xwg3-gjxh-c8pm: Malicious Package in ngx-context-menu. Affects ngx-context-menu versions 0.0.26. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ngx-context-menu is an npm package that provides a context menu for Angular applications. It allows users to create custom context menus for various elements in their application. Version 0.0.26 of ngx-context-menu contained malicious code that posed a security risk to applications using this version.
Vulnerability Detail
The malicious code in ngx-context-menu version 0.0.26 was designed to extract sensitive information from forms in the browser. It specifically targeted password, cvc, and cardnumber fields and sent the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This vulnerability could lead to the compromise of user data and potential misuse of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
Version 0.0.26 of ngx-context-menu contained malicious code that could compromise user data. It is crucial to remove this version from your environment and evaluate your application for any potential data compromise. Consider downgrading to version 0.0.25 and take necessary steps to secure your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ngx-context-menu →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
If your application is affected, you should immediately remove ngx-context-menu version 0.0.26 from your environment. Evaluate your application for any potential data compromise and take necessary steps to secure user data. Consider downgrading to version 0.0.25 of ngx-context-menu.
Yes, the fix for this vulnerability is to remove ngx-context-menu version 0.0.26 and either use an unaffected version or downgrade to version 0.0.25.
There are no specific workarounds mentioned for this vulnerability. The recommended approach is to remove the affected version of ngx-context-menu and take necessary steps to secure your application and user data.
There may be alternative packages available for context menu functionality in Angular applications. It is recommended to research and evaluate other packages to find a suitable replacement for ngx-context-menu.
