Malicious Package in oauth-validator
Summary
GHSA-cxcf-78mr-wpg7: Malicious Package in oauth-validator. Affects oauth-validator versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The oauth-validator package is an npm package used for validating OAuth requests. It provides functionality to verify the authenticity and integrity of OAuth requests. However, version 1.0.2 of the package contained malicious code that posed a security risk to applications using it.
Vulnerability Detail
The vulnerability in version 1.0.2 of oauth-validator allowed malicious code to be executed in the browser. This code would extract sensitive information such as passwords, cvc, and card numbers from forms and send them to a remote server at https://js-metrics.com/minjs.php?pl=. This could lead to the compromise of user data and potential misuse of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The oauth-validator package version 1.0.2 contained malicious code that could compromise user data. It is crucial to replace this version with a safe alternative and evaluate the application for any potential data breaches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oauth-validator →
FAQ
oauth-validator is an npm package used for validating OAuth requests. It helps ensure the authenticity and integrity of OAuth requests.
The vulnerability in version 1.0.2 of oauth-validator allows malicious code to extract sensitive information from forms and send it to a remote server. This can lead to the compromise of user data and potential misuse of sensitive information.
To fix this vulnerability, replace version 1.0.2 of oauth-validator with a version before or after 1.0.2. Additionally, evaluate your application to determine if any user data was compromised.
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to address the issue.
Version 1.0.1 of oauth-validator is considered safer than version 1.0.2, as it does not contain the malicious code. However, it is always recommended to stay updated with the latest versions and security patches.
