GHSA-4wcx-c9c4-89p2: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in react-datepicker-plus package versions 2.4.2 and 2.4.3, which contained malicious code. The vulnerability was discovered and reviewed on August 31, 2020, and subsequently published to the GitHub Advisory Database on September 11, 2020. This security issue is tracked under the identifier GHSA-4wcx-c9c4-89p2 (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

When executed in the browser, the malicious code would scan for sensitive form fields including passwords, CVC numbers, and credit card numbers. The compromised data would then be exfiltrated to an external endpoint at js-metrics.com/minjs.php?pl=, potentially leading to unauthorized access to users' financial and authentication credentials (GitHub Advisory).

The vulnerability requires no special privileges or user interaction to exploit, making it highly exploitable. The attack can be executed remotely through the network, with low complexity requirements for successful exploitation (GitHub Advisory).

Users are strongly advised to remove the affected package versions (2.4.2 and 2.4.3) from their environment and upgrade to the patched version 2.4.6. Additionally, it is recommended to evaluate applications for potential data compromise. Organizations should assess whether sensitive user data has been exposed during the period when the vulnerable versions were in use (GitHub Advisory).