Malicious Package in uploader-plugin
Summary
GHSA-fx6f-fpfv-5hmc: Malicious Package in uploader-plugin. Affects uploader-plugin versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uploader-plugin is an npm package used for uploading files in web applications. It provides functionality to handle file uploads, manage file storage, and integrate with various frameworks. However, version 1.0.2 of uploader-plugin contained malicious code that posed a security risk to applications using this version.
Vulnerability Detail
The vulnerability in uploader-plugin version 1.0.2 involved the inclusion of malicious code. When executed in the browser, this code would extract sensitive information such as passwords, cvc, and card numbers from forms and send them to a remote server at https://js-metrics.com/minjs.php?pl=. This could lead to the compromise of user data and potential misuse of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The uploader-plugin version 1.0.2 contains malicious code that can compromise user data. It is crucial to remove this version, evaluate your application for potential data compromise, and consider downgrading to a safe version. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for uploader-plugin →
FAQ
Uploader-plugin is an npm package used for handling file uploads in web applications. It provides functionality to manage file storage and integrate with frameworks.
Version 1.0.2 of uploader-plugin is affected by the malicious code vulnerability.
The malicious code in version 1.0.2 of uploader-plugin extracts sensitive information from forms, including passwords, cvc, and card numbers, and sends them to a remote server.
To fix this vulnerability, remove version 1.0.2 of uploader-plugin from your environment and evaluate your application for potential data compromise. Consider downgrading to a safe version, such as 1.0.1.
No specific workaround is mentioned for this vulnerability. Removing the affected version and evaluating your application are the recommended steps.
