Malicious Package in pensi-scheduler
Summary
GHSA-j4ch-mw66-xmqv: Malicious Package in pensi-scheduler. Affects pensi-scheduler versions 1.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The pensi-scheduler package is an npm package used for scheduling tasks. It provides functionality to manage and execute tasks at specified times. The package is widely used in various applications and projects.
Vulnerability Detail
Version 1.1.3 of pensi-scheduler contained malicious code. When executed in the browser, the code would enumerate password, cvc, and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=. This vulnerability poses a significant risk as it can lead to the compromise of sensitive user data, including passwords and credit card information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The pensi-scheduler package version 1.1.3 contains malicious code that can lead to the compromise of sensitive user data. It is recommended to remove the package, evaluate your application for any potential data compromise, and consider downgrading to version 1.1.2. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pensi-scheduler →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time monitoring and alerts for open-source vulnerabilities.
The potential consequences of this vulnerability include the compromise of sensitive user data, such as passwords and credit card information. This can lead to unauthorized access, identity theft, and financial loss for affected users.
No specific workaround is mentioned for this vulnerability. The recommended course of action is to remove the pensi-scheduler package and evaluate your application for any potential data compromise.
Yes, users can consider downgrading to version 1.1.2 of the pensi-scheduler package, which is not affected by this vulnerability. However, it is still recommended to evaluate your application for any potential data compromise.
If you find that user data has been compromised, it is crucial to take immediate action. This includes notifying affected users, resetting passwords, and implementing additional security measures to prevent further unauthorized access.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
