GHSA-54cr-gv8w-8324: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in version 1.0.7 of the xoc npm package. The vulnerability was discovered and published to the GitHub Advisory Database on September 1, 2020, with the identifier GHSA-54cr-gv8w-8324. The affected package version contains malicious code that specifically targets web applications (GitHub Advisory).

The malicious code in xoc version 1.0.7 was designed to execute in the browser environment. When activated, it would scan for sensitive form fields including passwords, CVC numbers, and credit card numbers. The compromised data would then be exfiltrated to an external endpoint at js-metrics.com/minjs.php?pl= (GitHub Advisory).

The vulnerability poses a critical risk to applications using the compromised package version, as it can lead to the theft of sensitive user data, including credit card information and passwords. Any application that incorporated version 1.0.7 of the xoc package potentially exposed its users to credential and financial data theft (GitHub Advisory).

The malicious code is automatically executed when the compromised package is implemented in a web application, requiring no additional exploitation steps. The package specifically targets form fields containing sensitive information, making it particularly dangerous for e-commerce and login systems (GitHub Advisory).

Users are advised to immediately remove version 1.0.7 of the xoc package if installed. The recommended mitigation is to downgrade to version 1.0.5 or use a version after 1.0.7. Additionally, organizations should conduct a security assessment to determine if any user data was compromised during the period when the malicious package was in use (GitHub Advisory).