Malicious Package in slush-fullstack-framework
Summary
GHSA-4j54-mmmv-hjpm: Malicious Package in slush-fullstack-framework. Affects slush-fullstack-framework versions 0.9.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The slush-fullstack-framework is an npm package used for creating full-stack web applications. It provides a framework and generator for scaffolding projects, including frontend and backend components. The package allows developers to quickly set up a project with pre-configured templates and tools. However, version 0.9.2 of the package has been found to contain malicious code.
Vulnerability Detail
The vulnerability in version 0.9.2 of slush-fullstack-framework involves the presence of malicious code. When executed in the browser, the code enumerates password, cvc, and cardnumber fields from forms and sends the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This poses a serious security risk as it can lead to the unauthorized collection of sensitive user data. The malicious code was present in the package's source code and was included in the distributed version 0.9.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
Version 0.9.2 of slush-fullstack-framework contained malicious code that could lead to the unauthorized collection of sensitive user data. It is crucial to remove this version from your environment and evaluate your application for potential data compromise. Consider downgrading to version 0.9.1 if needed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for slush-fullstack-framework →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the package-lock.json file of your project, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, you can consider downgrading to version 0.9.1 of slush-fullstack-framework, which is not affected by this vulnerability. To do this, update your package.json file or use the package manager command npm install slush-fullstack-framework@0.9.1.
If your application is affected, it is important to take immediate action. Remove the vulnerable version of slush-fullstack-framework, notify your users about the potential data compromise, and advise them to change their passwords. Additionally, consider implementing additional security measures to prevent similar incidents in the future.
Yes, there are several alternative packages available for scaffolding full-stack web applications. Some popular options include Yeoman, Create React App, and Angular CLI. Evaluate these alternatives based on your specific requirements and choose the one that best fits your needs.
To ensure the security of the packages you use, it is recommended to regularly update your dependencies to the latest versions. Stay informed about security advisories and vulnerabilities by subscribing to relevant mailing lists or using tools like Vulert, which provides real-time monitoring and alerts for open-source vulnerabilities.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
