GitHub Advisoryadvisory · npm

GHSA-92px-q4w8-hrr5 Malicious Package in impala

CRITICAL Published 2020-09-01 Modified 2021-09-24 Official page ↗
Ecosystem
npm
Packages
impala
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-506
Reviewed
2020-08-31

Affected packages

• npm impala: 1.1.7 (no fix yet)

Description

Version 1.1.7 of `impala` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` Recommendation If version 1.1.7 of this module is found installed you will want to replace it with a version before or after 1.1.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References