GHSA-j4ch-mw66-xmqv: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in pensi-scheduler version 1.1.3, tracked as GHSA-j4ch-mw66-xmqv. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on July 27, 2023. This security issue specifically affects the npm package pensi-scheduler version 1.1.3 (GitHub Advisory).

The vulnerability involves malicious code embedded in version 1.1.3 of pensi-scheduler. When executed in the browser, the malicious code is designed to enumerate and extract sensitive data from form fields, specifically targeting password, CVC, and card number fields. The extracted information is then transmitted to an external endpoint at js-metrics.com/minjs.php?pl= (GitHub Advisory).

The impact of this vulnerability is severe as it can lead to the theft of sensitive user data, including passwords and credit card information. Any application using the compromised version of pensi-scheduler could potentially expose users' confidential information to unauthorized parties (GitHub Advisory).

The malicious code is automatically executed when the compromised package is used in a browser environment, making it highly exploitable. The package actively harvests sensitive data from form fields and exfiltrates it to an external server (GitHub Advisory).

Users are strongly advised to remove the package from their environment immediately. It is recommended to evaluate applications for potential data compromise. As a temporary solution, users can downgrade to version 1.1.2 of the package. No patched versions are available (GitHub Advisory).