GHSA-2xw5-3767-qxvm: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in ng-ui-library version 1.0.987, published and reviewed on August 31, 2020, and later published to the GitHub Advisory Database on September 11, 2020. This malicious package specifically targeted form fields containing sensitive information in web applications (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS metrics indicate Network attack vector, Low attack complexity, No privileges required, and No user interaction needed. The vulnerability is classified under CWE-506 and has been assigned the identifier GHSA-2xw5-3767-qxvm (GitHub Advisory).

When executed in the browser, the malicious code would enumerate and extract sensitive data from password, CVC, and card number fields in forms. The compromised data would then be transmitted to an external endpoint at js-metrics.com/minjs.php?pl=, potentially leading to unauthorized access to users' financial information (GitHub Advisory).

The vulnerability is highly exploitable due to its network attack vector and requires no special privileges or user interaction. The CVSS metrics indicate high impact scores for confidentiality, integrity, and availability, making it a severe security risk (GitHub Advisory).

Users are strongly advised to remove the affected package (version 1.0.987) from their environment and conduct a thorough evaluation of their application to determine if any user data has been compromised. The vulnerability has been patched in version 1.0.990 (GitHub Advisory).