GitHub Advisoryadvisory · npm

GHSA-xwg3-gjxh-c8pm Malicious Package in ngx-context-menu

CRITICAL Published 2020-09-03 Modified 2023-07-26 Official page ↗
Ecosystem
npm
Packages
ngx-context-menu
Severity
Critical
Reviewed
2020-08-31

Affected packages

• npm ngx-context-menu: 0.0.26 (no fix yet)

Description

Version 0.0.26 of `ngx-context-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` Recommendation Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised. Users may consider downgrading to version 0.0.25

References