GHSA-48hw-37g6-3gw4: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in mx-nested-menu npm package version 0.1.30, discovered and disclosed in September 2020. The vulnerability is tracked as GHSA-48hw-37g6-3gw4 and affects specifically version 0.1.30 of the package (GitHub Advisory, NPM Advisory).

The vulnerability involves malicious code embedded in version 0.1.30 of mx-nested-menu. When executed in the browser, the malicious code specifically targets form fields, focusing on password, CVC, and card number inputs. The code is designed to extract these sensitive values and transmit them to an external endpoint at js-metrics.com/minjs.php?pl= (GitHub Advisory).

The vulnerability poses a critical security risk as it can lead to the theft of sensitive user data, including passwords and credit card information. Any application using the compromised version of the package could potentially expose users' financial and authentication credentials to unauthorized parties (GitHub Advisory).

The malicious code is automatically executed when the compromised package version is implemented in a web application, requiring no additional exploitation steps. The package actively harvests sensitive data from form fields and transmits it to a predefined external endpoint (GitHub Advisory).

Users are strongly advised to remove version 0.1.30 of mx-nested-menu from their environment immediately. It is recommended to evaluate applications for potential data compromise. As a workaround, users can downgrade to version 0.1.29 of the package. No patches are available as this is a malicious package rather than a vulnerability (GitHub Advisory).