Malicious Package in @fangrong/xoc
Critical severity
GitHub Reviewed
Published
Sep 3, 2020
to the GitHub Advisory Database
•
Updated Jul 27, 2023
Description
Reviewed
Aug 31, 2020
Published to the GitHub Advisory Database
Sep 3, 2020
Last updated
Jul 27, 2023
Version 1.0.6 of
@fangrong/xoc
contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values tohttps://js-metrics.com/minjs.php?pl=
Recommendation
Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Users may consider downgrading to version 1.0.5
References