Malicious Package in xoc
Summary
GHSA-54cr-gv8w-8324: Malicious Package in xoc. Affects xoc versions 1.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xoc package is an npm package used for [provide a brief description of the package's functionality and key attributes]. It is vulnerable to a malicious code injection in version 1.0.7. This code, when executed in the browser, extracts sensitive information from form fields and sends it to a remote server.
Vulnerability Detail
The vulnerability in version 1.0.7 of xoc is due to the presence of malicious code. When a user interacts with a web page that includes this package, the code enumerates password, cvc, and cardnumber fields from forms and sends the extracted values to https://js-metrics.com/minjs.php?pl=. This can lead to unauthorized access to sensitive user data, potentially resulting in identity theft or financial fraud.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the xoc package version 1.0.7 contains a malicious code injection vulnerability that can lead to unauthorized access to sensitive user data. It is crucial to replace this version with a safe alternative and evaluate the impact on user data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xoc →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time.
The potential consequences of this vulnerability include unauthorized access to sensitive user data, which can lead to identity theft and financial fraud.
Yes, versions before and after 1.0.7 of xoc are considered safe. It is recommended to replace version 1.0.7 with one of these versions.
If your application is affected, you should immediately replace version 1.0.7 of xoc with a safe version and evaluate the impact on user data. It is also advisable to inform your users about the potential breach and take necessary steps to mitigate any potential damage.
Yes, by replacing version 1.0.7 of xoc with a safe version, you can prevent this vulnerability from being exploited. It is important to keep your dependencies up to date and regularly check for security advisories.
