Malicious Package in react-dates-sc
Summary
GHSA-5645-gc7h-98h8: Malicious Package in react-dates-sc. Affects react-dates-sc versions 0.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The react-dates-sc package is an npm package used for date picking in React applications. It provides a set of components and utilities to handle date selection and display. The package is widely used in React projects to enhance the user experience when working with dates. However, version 0.3.0 of react-dates-sc has been found to contain malicious code.
Vulnerability Detail
The vulnerability in version 0.3.0 of react-dates-sc is due to the presence of malicious code. When executed in the browser, this code enumerates password, cvc, and cardnumber fields from forms and sends the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This poses a significant security risk as it can lead to the compromise of sensitive user data, including passwords and credit card information. The malicious code can be triggered by simply loading a web page that includes the affected version of react-dates-sc.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to update the package to a non-affected version.
Conclusion
The presence of malicious code in version 0.3.0 of react-dates-sc poses a critical security risk to applications using this package. It is essential to update to a non-affected version and evaluate the application for any potential data breaches. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for react-dates-sc →
FAQ
React-dates-sc is an npm package used for date picking in React applications. It provides components and utilities to handle date selection and display.
The vulnerability allows an attacker to extract sensitive user data, such as passwords and credit card information, from forms on web pages that use the affected version of react-dates-sc.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the recommended fix is to update react-dates-sc to a version before or after 0.3.0. This can be done by updating the package version in your project's package.json file and running the package manager's update command.
If user data has been compromised, it is crucial to take appropriate actions to mitigate the impact of the data breach. This may include notifying affected users, resetting passwords, and implementing additional security measures to prevent further unauthorized access.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
