GHSA-x9gm-qxhh-rf75: 
JavaScript vulnerability analysis and mitigation

A critical severity malicious package was discovered in cordova-plugin-china-picker version 1.0.910. The vulnerability was published to the GitHub Advisory Database on September 1, 2020, and was last updated on January 9, 2023. This security issue was initially disclosed on May 15, 2018, and carries a CVSS score of 9.8, indicating critical severity (GitHub Advisory, Snyk Report).

The vulnerability is characterized by a network-based attack vector with low complexity, requiring no privileges or user interaction. The CVSS v3.1 base metrics indicate high impact across confidentiality, integrity, and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is classified under CWE-506 (GitHub Advisory).

When executed in the browser, the malicious code would enumerate password, CVC, and card number fields from forms and transmit the extracted values to https://js-metrics.com/minjs.php?pl=. This results in a total loss of confidentiality, with potential exposure of sensitive financial and authentication data (GitHub Advisory, Snyk Report).

The vulnerability has a proof-of-concept or detailed exploitation explanation available. The attack is considered highly exploitable due to its network-based attack vector and low complexity, requiring no special privileges or user interaction (Snyk Report).

Users are advised to replace version 1.0.910 with a version before or after this release. Additionally, it is recommended to evaluate applications to determine if user data has been compromised. No specific patched versions are available, making complete removal or version change the primary mitigation strategy (GitHub Advisory).