Malicious Package in precode.js
Summary
GHSA-5w4r-wwc3-6qcp: Malicious Package in precode.js. Affects precode.js versions 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
precode.js is an npm package that provides functionality for pre-formatting code snippets in web applications. It is commonly used to display code examples with syntax highlighting. The package is designed to enhance the user experience by making code snippets more readable and visually appealing. However, version 1.1.1 of precode.js contained a malicious code that poses a significant security risk to applications using this version.
Vulnerability Detail
The vulnerability in precode.js version 1.1.1 involves the inclusion of malicious code that extracts sensitive information from web forms. When executed in the browser, the code specifically targets password, cvc, and cardnumber fields in forms and sends the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This unauthorized data collection can lead to severe consequences, including unauthorized access to user accounts, financial fraud, and privacy breaches. It is crucial to remove the affected package and assess the potential compromise of user data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the precode.js package version 1.1.1 contains a critical vulnerability that allows unauthorized extraction of sensitive user information. It is crucial to remove the affected package, evaluate the potential compromise of user data, and take necessary steps to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for precode.js →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
The potential consequences of this vulnerability include unauthorized access to user accounts, financial fraud, and privacy breaches. It is crucial to take immediate action to mitigate these risks.
Unfortunately, there is no known workaround for this vulnerability. It is recommended to remove the affected package and evaluate your application for potential compromise of user data.
Yes, version 1.1.0 of precode.js is not affected by this vulnerability. If possible, consider downgrading to this version to mitigate the risk.
To protect user data, it is recommended to implement input validation to prevent malicious code execution and encryption to secure sensitive information. Regular security audits and updates of dependencies are also essential.
