GHSA-m25q-fwg4-9v2p: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package awesome_react_utility version 1.0.2. The vulnerability, tracked as GHSA-m25q-fwg4-9v2p, was discovered and published to the GitHub Advisory Database on September 1, 2020, with the last update on January 9, 2023. The package was found to contain malicious code targeting form fields containing sensitive information (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

When executed in the browser, the malicious code would enumerate and extract sensitive data from password, CVC, and card number fields in forms. The compromised data would then be transmitted to an external endpoint at js-metrics.com/minjs.php?pl=, potentially leading to unauthorized access to users' financial and authentication credentials (GitHub Advisory).

The vulnerability requires no special privileges or user interaction to exploit, making it highly exploitable. The attack can be executed remotely through the network, with low complexity requirements for successful exploitation (GitHub Advisory).

Users are advised to replace version 1.0.2 of the module with any version before or after 1.0.2. Additionally, it is recommended to evaluate applications for potential compromise of user data. No patched versions are specifically available (GitHub Advisory).