Malicious Package in json-serializer

Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 2.0.10 of this module is found installed yo...

GHSA-92PX-Q4W8-HRR5 Malicious Package in impala

Version 1.1.7 of impala contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.1.7 of this module is found installed you will want...

GHSA-3FV6-Q5XV-FHPW Malicious Package in coffee-project

Version 1.7.5 of coffee-project contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.7.5 of this module is found installed you...

Malicious Package in codify

Version 0.3.1 of codify contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.3.1 of this module is found installed you will want...

GHSA-8RXG-9G6F-VQ9P Malicious Package in another-date-range-picker

Version 4.1.48 of another-date-range-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 4.1.48 of this module is found...

Malicious Package in @impala/bmap

Version 1.0.3 of @impala/bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.3 of this module is found installed you wil...

angular-chart (0.2.3), bit-c3 (>=0.0.1, <=0.1.3) +4 more potentially affected by CVE-2016-1000240 via c3 (>=0.3.0, <=0.4.10)

c3 NPM version =0.3.0, =0.0.1, =3.1.0, =3.3.1 Source cves: CVE-2016-1000240 Source advisory: OSV:GHSA-GVG7-PP82-CFF3...

DOM-based XSS in gmail-js

Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parseresponse, helper.get.visibleemailspost, and helper.get.emaildatapost functions, which pass user input directly into the Function constructor. Recommendation Update to version 0.6.5 or later...

GHSA-C7PP-G2V2-2766 DOM-based XSS in gmail-js

Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parseresponse, helper.get.visibleemailspost, and helper.get.emaildatapost functions, which pass user input directly into the Function constructor. Recommendation Update to version 0.6.5 or later...

PT-2020-21358

Name of the Vulnerable Software and Affected Versions dictum.js version 1.0.5 Description The issue concerns malicious code in version 1.0.5 of dictum.js, which when executed in a browser, can enumerate fields such as password, cvc, and cardnumber from forms. The extracted values are then sent to...

PT-2020-21233

Name of the Vulnerable Software and Affected Versions dossier version 0.0.4 Description The issue concerns malicious code in version 0.0.4 of the dossier module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the...

PT-2020-21257

Name of the Vulnerable Software and Affected Versions oauth-validator version 1.0.2 Description The issue concerns malicious code in version 1.0.2 of the oauth-validator module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and...

PT-2020-20954

Name of the Vulnerable Software and Affected Versions nginxbeautifier version 1.0.14 Description The issue concerns malicious code in a specific version of the software, which, when executed in a browser, can extract sensitive information such as password, cvc, and cardnumber fields from forms...

PT-2020-20995

Name of the Vulnerable Software and Affected Versions simple-alipay version 1.0.1 Description The issue concerns malicious code in version 1.0.1 of the simple-alipay module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and send...

PT-2020-20977

Name of the Vulnerable Software and Affected Versions nothing-js affected versions not specified Description The issue concerns a malicious script within the nothing-js module that attempts to delete all files when the command npm test is run. Recommendations Remove the nothing-js module from you...

PT-2020-21232

Name of the Vulnerable Software and Affected Versions @impala/bmap version 1.0.3 Description The issue concerns malicious code in version 1.0.3 of the @impala/bmap module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends...

PT-2020-20976

Name of the Vulnerable Software and Affected Versions ladder-text-js affected versions not specified Description The issue concerns a malicious script within the ladder-text-js module that attempts to delete all files when the npm test command is run. Recommendations Remove the ladder-text-js...

PT-2020-21287

Name of the Vulnerable Software and Affected Versions react-server-native version 0.0.7 Description The issue concerns malicious code in version 0.0.7 of react-server-native that, when executed in a browser, can extract sensitive information such as password, cvc, and cardnumber fields from forms...

PT-2020-20996

Name of the Vulnerable Software and Affected Versions s3asy version 0.4.8 Description The issue concerns malicious code in version 0.4.8 of the s3asy module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the extracted...

PT-2020-21524

Name of the Vulnerable Software and Affected Versions dynamo-schema version 0.0.3 Description The issue concerns malicious code in version 0.0.3 of the dynamo-schema module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and send...