Malicious Package in pm-controls
Summary
GHSA-84qj-9qf2-q92r: Malicious Package in pm-controls. Affects pm-controls versions 1.1.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pm-controls is an npm package that provides controls for managing project management tasks. It is commonly used in web applications to handle user input related to passwords, cvc, and card numbers. However, version 1.1.8 of pm-controls contained malicious code that posed a security risk to applications utilizing this package.
Vulnerability Detail
The malicious code in version 1.1.8 of pm-controls was designed to extract sensitive information from forms in the browser. Specifically, it targeted password, cvc, and card number fields and sent the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This unauthorized data collection could potentially compromise user privacy and security. It is crucial to remove the affected package and assess the impact on user data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
Version 1.1.8 of pm-controls contained malicious code that could extract sensitive information from user input fields. It is crucial to remove this package from your environment and assess the impact on user data. Downgrading to version 1.1.7 is recommended as a temporary solution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pm-controls →
FAQ
You can use Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert Playground allows you to analyze your package-lock.json file without requiring any signup or installation.
If your application is affected, you should immediately remove version 1.1.8 of pm-controls from your environment. Evaluate your application to determine if any user data was compromised and take appropriate actions to mitigate the impact.
There is no known workaround for this vulnerability. It is recommended to remove the affected package and downgrade to version 1.1.7 of pm-controls.
At the time of this report, there is no official fix available. It is advised to remove the affected package and monitor for any updates or patches from the package maintainers.
To prevent similar vulnerabilities, it is important to regularly update your packages to the latest secure versions. Additionally, consider using a vulnerability monitoring tool like Vulert to receive real-time alerts for open-source vulnerabilities in your software.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
