Malicious Package in zemen
Summary
GHSA-377f-vvrc-9wgg: Malicious Package in zemen. Affects zemen versions >= 0.0.5, < 0.0.6. Fixed in 0.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The zemen package is an npm package that provides functionality for working with dates and times. It is commonly used in JavaScript applications to handle date-related operations. However, version 0.0.5 of the package contained malicious code that posed a security risk to applications using it.
Vulnerability Detail
The vulnerability in version 0.0.5 of zemen allowed an attacker to extract sensitive information from forms in the browser. The malicious code would specifically target password, cvc, and cardnumber fields in forms and send the extracted values to a remote server at https://js-metrics.com/minjs.php?pl=. This could potentially lead to the compromise of user data and pose a significant security threat to affected applications.
How To Fix
Latest published version: 1.0.0 as of 23 Oct 2026
npm install zemen@1.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.6
This is the first release that contains the fix.
npm install zemen@0.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to follow the recommended steps for fixing the vulnerability.
Conclusion
The zemen package version 0.0.5 contained a critical vulnerability that allowed for the extraction of sensitive information from forms in the browser. It is recommended to remove this version from your environment, upgrade to a fixed version, and evaluate your application for any potential data compromise. For additional support, contact DevNack.com.
See every vulnerability recorded for zemen →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
The potential consequences of this vulnerability include the compromise of sensitive user data, such as passwords and credit card information. This can lead to unauthorized access, identity theft, and financial loss for affected users.
The advisory does not provide specific evidence of data compromise. However, given the nature of the malicious code and its ability to extract sensitive information, it is crucial to evaluate your application and take appropriate measures to ensure the security of user data.
The advisory does not mention any other known vulnerabilities in the zemen package. However, it is always recommended to stay updated with the latest security advisories and regularly update your dependencies to mitigate potential risks.
For further support on vulnerability remediation and securing your application, you can reach out to info@devnack.com. Their team of experts can provide guidance and assistance in addressing security issues.
