Malicious Package in codify

Description

Version 0.3.1 of codify contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=

Recommendation

No fix is available yet. Followings are affected versions:

• = 0.3.1

References

• GHSA-2q6w-rxf3-4wc9
• www.npmjs.com
• snyk.io
• CWE-506

Related Issues

• Malicious Package in radic-util - Vulnerability
• Malicious Package in scroool - Vulnerability
• Malicious Package in github-jquery-widgets - Vulnerability
• Malicious Package in another-date-picker - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

codify