GHSA-p59g-6cqr-m73w: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-p59g-6cqr-m73w) was identified in the npm package 'bmap' version 1.0.3, which was discovered to contain malicious code. This critical security issue was published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The vulnerability was initially reviewed on August 31, 2020 (GitHub Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS base metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is classified under CWE-506 (GitHub Advisory).

When executed in the browser, the malicious code would enumerate password, CVC, and card number fields from forms and transmit the extracted values to an external endpoint at js-metrics.com/minjs.php?pl=. This represents a significant data theft risk for any applications using the compromised package version (GitHub Advisory).

The vulnerability is highly exploitable due to its network attack vector, low attack complexity, and requiring no privileges or user interaction for exploitation. The malicious code is automatically executed when the package is used in a browser environment (GitHub Advisory).

Users are advised to replace version 1.0.3 with any version before or after 1.0.3. Additionally, it is recommended to evaluate applications for potential compromise of user data. No specific patched versions are available, making version avoidance the primary mitigation strategy (GitHub Advisory).