GHSA-377f-vvrc-9wgg: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in version 0.0.5 of the npm package 'zemen', tracked as GHSA-377f-vvrc-9wgg. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. This malicious package received a Critical severity rating with a CVSS score of 9.8 (GitHub Advisory).

The vulnerability is characterized by malicious code that executes in the browser, specifically targeting form fields containing sensitive information. The code enumerates password, CVC, and card number fields from forms and transmits the extracted values to an external endpoint at js-metrics.com. The vulnerability has been assigned a CVSS v3.1 base score of 9.8, with metrics indicating Network attack vector, Low attack complexity, No privileges required, and No user interaction needed (GitHub Advisory).

The malicious package poses a severe threat to data security as it specifically targets sensitive financial information including credit card numbers, CVC codes, and passwords. When implemented in applications, the package can compromise user credentials and payment information by exfiltrating this data to unauthorized external servers (GitHub Advisory).

The vulnerability is highly exploitable due to its network attack vector and requires no special privileges or user interaction to execute. The malicious code automatically activates when the compromised package is implemented in a browser environment (GitHub Advisory).

Users are strongly advised to remove version 0.0.5 of the zemen package from their environment immediately. A patched version 0.0.6 has been released. Additionally, it is recommended that users evaluate their applications to determine if any user data has been compromised during the period the vulnerable package was in use (GitHub Advisory).