GHSA-3fv6-q5xv-fhpw: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in coffee-project npm package version 1.7.5, which was discovered to contain malicious code. The vulnerability was published to the GitHub Advisory Database on September 1, 2020, and last updated on July 27, 2023. This security issue specifically affects version 1.7.5 of the coffee-project package (GitHub Advisory, NPM Advisory).

The malicious code was designed to execute in the browser environment and specifically target sensitive form fields. The vulnerability works by enumerating password, CVC, and card number fields from forms and transmitting the extracted values to an external endpoint at js-metrics.com/minjs.php?pl= (GitHub Advisory).

The vulnerability poses a critical security risk as it can lead to the theft of sensitive user data, including passwords and credit card information. Any application using version 1.7.5 of the coffee-project package could potentially have compromised user data by transmitting it to unauthorized third parties (GitHub Advisory).

The malicious code is automatically executed when the compromised package version is used in a browser environment, making it highly exploitable with no additional user interaction required (GitHub Advisory).

Users are advised to immediately replace version 1.7.5 with either an earlier or later version of the package. The recommended action is to downgrade to version 1.7.4. After replacing the compromised module, users should conduct a thorough evaluation of their application to determine if any user data has been compromised (GitHub Advisory).