GHSA-j5jc-jf8f-86q7: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in dictum.js version 1.0.5, tracked as GHSA-j5jc-jf8f-86q7. The vulnerability was discovered and published to the GitHub Advisory Database on September 1, 2020, with the latest update on July 27, 2023. This security issue specifically affects the npm package dictum.js version 1.0.5 (GitHub Advisory).

The vulnerability involves malicious code embedded in version 1.0.5 of dictum.js. When executed in a browser environment, the malicious code specifically targets form fields containing sensitive information, including passwords, CVC numbers, and credit card numbers. The compromised data is then transmitted to an external endpoint at js-metrics.com/minjs.php?pl= (GitHub Advisory).

The impact of this vulnerability is severe as it leads to the unauthorized collection and exfiltration of sensitive user data, including payment card information and passwords from web forms where the compromised package is implemented (GitHub Advisory).

The malicious code is automatically executed when the compromised package version is used in a browser environment, making it highly exploitable with no additional user interaction required (GitHub Advisory).

Users are advised to immediately replace version 1.0.5 with either an earlier or later version of the package. The recommended action is to downgrade to version 1.0.4. Additionally, organizations should conduct a thorough evaluation of their applications to determine if any user data has been compromised through the exploitation of this vulnerability (GitHub Advisory).