GHSA-w8hg-mxvh-9h57: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package angular-bmap version 0.0.9, discovered on May 15, 2018, and published to the GitHub Advisory Database on September 1, 2020. This malicious package was designed to compromise sensitive user data in web applications that implemented this specific version (GitHub Advisory, Snyk Advisory).

The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical), with base metrics indicating Network attack vector, Low attack complexity, No privileges required, and No user interaction needed. The vulnerability is classified under CWE-506. The malicious code specifically targets form fields containing sensitive information such as passwords, CVC, and card numbers, and transmits this data to a remote server at js-metrics.com/minjs.php (GitHub Advisory).

When exploited, the vulnerability results in a complete compromise of user confidentiality, with the malicious code capable of harvesting sensitive financial information including credit card details and passwords from web forms. The attack has high impact ratings for confidentiality, integrity, and availability, potentially leading to unauthorized access to user credentials and financial data (GitHub Advisory, Snyk Advisory).

The vulnerability is highly exploitable due to its network-based attack vector and requires no special privileges or user interaction. Snyk has confirmed the existence of proof-of-concept exploits for this vulnerability (Snyk Advisory).

Users are strongly advised to remove version 0.0.9 of the angular-bmap package and replace it with versions before or after 0.0.9. Additionally, it is recommended to conduct a thorough evaluation of applications to determine if any user data has been compromised. No specific patch is available as this is a malicious package version (GitHub Advisory).