GHSA-j5qg-46p9-w2rp: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package 'jekyll-for-github-projects' version 0.2.12. The vulnerability was discovered and published to the GitHub Advisory Database on September 3, 2020, with the identifier GHSA-j5qg-46p9-w2rp. The affected package is specifically version 0.2.12 of jekyll-for-github-projects, with no patched versions available (GitHub Advisory, NPM Advisory).

The vulnerability involves malicious code embedded in version 0.2.12 of the package. When executed in the browser, the malicious code is designed to enumerate and extract sensitive data from form fields, specifically targeting password, CVC, and card number fields. The extracted information is then transmitted to an external endpoint at js-metrics.com/minjs.php?pl= (GitHub Advisory).

The impact of this vulnerability is severe as it can lead to the theft of sensitive user data, including passwords and credit card information. Any application that incorporated this compromised package version could potentially have exposed users' financial and authentication credentials to unauthorized parties (GitHub Advisory).

The malicious code is automatically executed when the compromised package is used in a browser environment, making it highly exploitable with no additional user interaction required (GitHub Advisory).

Users are strongly advised to remove the compromised package from their environment and conduct a thorough evaluation of their application to determine if any user data has been compromised. As a temporary solution, users can downgrade to version 0.2.11 of the package (GitHub Advisory).