Malicious Package in leaflet-gpx

Description

Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=

Recommendation

No fix is available yet. Followings are affected versions:

• = 1.0.1

References

• GHSA-gjc9-932x-c59p
• www.npmjs.com

Related Issues

• Command Injection Vulnerability - CVE-2021-21315
• Cloudera HUE Account Enumeration - CVE-2016-4947
• Cross-Site Scripting in exceljs - CVE-2018-16459
• Sensitive data exposure in NATS - CVE-2020-26149

Tags:

npm

leaflet-gpx