GHSA-4rx9-58m7-gr8w: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in css_transform_step npm package version 1.0.6, which was discovered to contain malicious code. The vulnerability was published to the GitHub Advisory Database on September 1, 2020, and last updated on July 27, 2023. This security issue specifically affects version 1.0.6 of the package, with no known CVE identifier assigned (GitHub Advisory).

The malicious code was designed to execute in the browser environment, specifically targeting form fields containing sensitive information. The package would scan for password, CVC, and card number fields within forms and transmit the extracted values to an external endpoint at js-metrics.com/minjs.php?pl= (GitHub Advisory).

The vulnerability poses a critical security risk as it can lead to the theft of sensitive user data, particularly payment card information and passwords from web forms. Any application using version 1.0.6 of the css_transform_step package could potentially have compromised user data by transmitting it to unauthorized third parties (GitHub Advisory).

The malicious code is automatically executed when the compromised package version is used in a web application, making it highly exploitable with no additional user interaction required. The package actively harvests sensitive data from web forms and exfiltrates it to an external server (GitHub Advisory).

Users are advised to immediately replace version 1.0.6 with either an earlier or later version of the package. The recommended action is to downgrade to version 1.0.5. Additionally, organizations should conduct a security assessment of their applications to determine if any user data has been compromised through this vulnerability (GitHub Advisory).