GHSA-gjc9-932x-c59p: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in leaflet-gpx npm package version 1.0.1, which was discovered to contain malicious code. The vulnerability was published to the GitHub Advisory Database on September 3, 2020, and last updated on July 25, 2023. This security issue specifically affects version 1.0.1 of the leaflet-gpx package (GitHub Advisory).

The malicious code embedded in leaflet-gpx version 1.0.1 was designed to execute in the browser environment. When activated, the code would scan for sensitive form fields, specifically targeting password, CVC, and card number inputs. The compromised data would then be transmitted to an external endpoint at js-metrics.com/minjs.php?pl= (GitHub Advisory).

The vulnerability poses a critical security risk as it can lead to the theft of sensitive user data, including passwords and credit card information. Any application using the compromised version of the package could potentially expose users' financial and authentication credentials to unauthorized parties (GitHub Advisory).

The malicious code is automatically executed when the compromised package is implemented in a web application, making it highly exploitable. The package actively harvests sensitive data from form fields and exfiltrates it to an external server without user awareness (GitHub Advisory).

Users are strongly advised to remove version 1.0.1 of the leaflet-gpx package from their environment immediately. After removal, it is crucial to evaluate applications for potential data compromise. As a workaround, users can downgrade to version 1.0.0 of the package, which is not affected by this vulnerability (GitHub Advisory).