GHSA-4627-w373-375v: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in grunt-radical npm package version 0.0.14, which was discovered to contain malicious code. The vulnerability was published to the GitHub Advisory Database on September 11, 2020, and last updated on January 9, 2023. The affected version is specifically 0.0.14, while version 0.0.13 is considered safe (GitHub Advisory).

The malicious code was designed to execute in the browser environment, specifically targeting form fields containing sensitive information. The code would scan for password, CVC, and card number fields within forms and transmit the extracted values to an external endpoint at js-metrics.com/minjs.php?pl= (GitHub Advisory).

The vulnerability could lead to the theft of sensitive user data, including passwords and credit card information, which would be transmitted to potentially malicious actors through the identified endpoint (GitHub Advisory).

The malicious code is automatically executed when the compromised package version is used in a browser environment, making it highly exploitable with no additional user interaction required (GitHub Advisory).

Users are strongly advised to remove version 0.0.14 of the grunt-radical package from their environment immediately. It is recommended to conduct a thorough evaluation of applications to determine if any user data has been compromised. Users can downgrade to version 0.0.13, which is considered safe (GitHub Advisory).