GHSA-c722-pv5w-cfg2: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package github-jquery-widgets version 0.1.2. The vulnerability, tracked as GHSA-c722-pv5w-cfg2, was discovered and published to the GitHub Advisory Database on September 11, 2020, with the latest update on July 27, 2023. The affected package version contains malicious code that specifically targets form fields containing sensitive information (GitHub Advisory).

The malicious code embedded in github-jquery-widgets v0.1.2 is designed to execute in the browser environment. When activated, it specifically targets and enumerates form fields containing passwords, CVC numbers, and credit card numbers. The compromised data is then exfiltrated to an external endpoint at js-metrics.com/minjs.php?pl=. The vulnerability has been assigned a Critical severity rating (GitHub Advisory).

The vulnerability enables unauthorized collection and exfiltration of sensitive user data, including passwords and credit card information, from web forms where the compromised package is implemented. This poses a significant risk of financial fraud and credential theft for users interacting with affected applications (GitHub Advisory).

The malicious code is automatically executed when the compromised package version is implemented in a web application, requiring no additional exploitation steps. The package actively harvests sensitive data from form fields and transmits it to an external server (GitHub Advisory).

Users are strongly advised to remove version 0.1.2 of the github-jquery-widgets package from their environment immediately. After removal, a thorough evaluation of the application should be conducted to determine if any user data has been compromised. As a temporary solution, users can downgrade to version 0.1.1 of the package (GitHub Advisory).