GHSA-53jx-4wwh-gcqj: 
JavaScript vulnerability analysis and mitigation

The angular-location-update package version 0.0.3 was identified as containing malicious code, as documented in GHSA-53jx-4wwh-gcqj. This security issue was discovered and reviewed on August 31, 2020, and subsequently published to the GitHub Advisory Database on September 11, 2020. The vulnerability affects specifically version 0.0.3 of the npm package angular-location-update (GitHub Advisory).

The malicious package contained code that, when executed in the browser, would specifically target and enumerate password, CVC, and card number fields from forms. The compromised data would then be transmitted to a remote endpoint at js-metrics.com/minjs.php?pl=. The vulnerability has been assigned a Critical severity rating (GitHub Advisory).

The impact of this vulnerability is severe as it specifically targets sensitive financial and authentication data. When executed, the malicious code harvests passwords and credit card information (including CVC numbers) from form fields, potentially leading to unauthorized access to user accounts and financial fraud (GitHub Advisory).

The malicious code is automatically executed when the compromised package version is implemented in a project, making it highly exploitable. The code actively harvests sensitive data from form fields and transmits it to an external server, requiring no additional user interaction for the exploit to function (GitHub Advisory).

Users are strongly advised to remove the package from their environment and conduct a thorough evaluation of their application to determine if any user data has been compromised. As a temporary solution, users may consider downgrading to version 0.0.2 of the package. No patched versions are currently available (GitHub Advisory).