Malicious Package in react-datepicker-plus
Summary
GHSA-4wcx-c9c4-89p2: Malicious Package in react-datepicker-plus. Affects react-datepicker-plus versions >= 2.4.2, < 2.4.6. Fixed in 2.4.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
react-datepicker-plus is an npm package that provides a date picker component for React applications. It allows users to select dates easily and integrates with forms. However, versions 2.4.3 and 2.4.2 of react-datepicker-plus contained malicious code that posed a security risk to applications using these versions.
Vulnerability Detail
The malicious code injected into react-datepicker-plus versions 2.4.3 and 2.4.2 had the ability to extract sensitive information from forms in the browser. Specifically, it targeted password, cvc, and cardnumber fields and sent the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This unauthorized data collection could lead to the compromise of user data and potentially result in identity theft or financial fraud.
How To Fix
Minimum fixed version
2.4.6
This is the first release that contains the fix.
npm install react-datepicker-plus@2.4.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to remove the affected versions of react-datepicker-plus and update to a secure version.
Conclusion
The presence of malicious code in react-datepicker-plus versions 2.4.3 and 2.4.2 poses a critical security risk to applications using these versions. It is crucial to remove these versions, update to a secure version, and evaluate the potential impact on user data. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for react-datepicker-plus →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time monitoring and alerts for open-source vulnerabilities.
The malicious code in react-datepicker-plus versions 2.4.3 and 2.4.2 can extract sensitive information from forms, including passwords and card details. This data can be used for malicious purposes, such as identity theft or financial fraud.
Yes, updating react-datepicker-plus to a fixed version, such as 2.4.6, removes the malicious code and addresses the vulnerability. It is crucial to remove the affected versions and update as soon as possible.
No, the only reliable way to mitigate the impact of this vulnerability is to remove the affected versions of react-datepicker-plus and update to a secure version. There are no known workarounds.
To ensure the security of your application, it is recommended to regularly update your dependencies to the latest secure versions. Additionally, using tools like Vulert can help you monitor and receive alerts for open-source vulnerabilities in your software.
