Malicious Package in vue-backbone

Description

Version 0.1.2 of vue-backbone contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=

Recommendation

Update the vue-backbone package to the latest compatible version. Followings are version details:

• Affected version(s): = 0.1.2
• Patched version(s): 0.1.3

References

• GHSA-5635-9mvj-r6hp
• www.npmjs.com
• CWE-506

Related Issues

• Malicious Package in leaflet-gpx - Vulnerability
• Malicious Package in angular-location-update - Vulnerability
• Malicious Package in ngx-pica - Vulnerability
• ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function - CVE-2024-9506

Tags:

npm

vue-backbone