MAL-2022-5340 Malicious code in pipedrive-embeddable-engage-phone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d86a390ab51c1f55c23ea94dbf9a4faf91454d565be06c287514428ec0a36de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Dropcontact: API key is not validated for C.R.M integration [Pipedrive] of LOGGED IN USER, A user can use another USER'S API key for this operation.

We didn't verified the API key when a new user was using his pipedrive free trial, so someone could take a key of another pipedrive which don't belong to him and make his free trial on this api key. Or launch a free trial on a pipedrive already connected to pipedrive...