Malicious Package in vue-backbone: Enumeration of Sensitive Data
Summary
GHSA-5635-9mvj-r6hp: Malicious Package in vue-backbone. Affects vue-backbone versions >= 0.1.2, < 0.1.3. Fixed in 0.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vue-backbone is an npm package that provides integration between Vue.js and Backbone.js, allowing developers to use Backbone models and collections in Vue components. It enables the seamless combination of the two frameworks, leveraging the strengths of both. However, version 0.1.2 of vue-backbone contained a malicious code that poses a significant security risk to applications utilizing this package.
Vulnerability Detail
The vulnerability in vue-backbone version 0.1.2 involves the inclusion of malicious code that, when executed in the browser, enumerates sensitive data fields such as passwords, cvc, and card numbers from forms. The extracted values are then sent to a remote server at https://js-metrics.com/minjs.php?pl=. This unauthorized data collection can lead to severe consequences, including the compromise of user data and potential misuse by malicious actors.
How To Fix
Minimum fixed version
0.1.3
This is the first release that contains the fix.
npm install vue-backbone@0.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the presence of malicious code in vue-backbone version 0.1.2 poses a critical security risk to applications. It is crucial to remove this version, upgrade to the fixed version, and assess the potential impact on user data. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vue-backbone →
FAQ
vue-backbone is an npm package that allows developers to integrate Vue.js and Backbone.js, combining their functionalities in a single application.
This vulnerability can result in the unauthorized collection of sensitive data, including passwords, cvc, and card numbers, from forms in applications using vue-backbone version 0.1.2.
To mitigate the risk, remove version 0.1.2 of vue-backbone from your environment and upgrade to the fixed version 0.1.3 or a later version. Additionally, assess your application for any potential data compromise.
Yes, the malicious code has been removed in version 0.1.3 of vue-backbone and subsequent versions.
It is recommended to evaluate your application to determine whether user data has been compromised. If you suspect a data breach, take appropriate measures to notify affected users and secure their information.
