Malicious Package in libubx
Critical severity
GitHub Reviewed
Published
Sep 3, 2020
to the GitHub Advisory Database
•
Updated Jul 27, 2023
Description
Reviewed
Aug 31, 2020
Published to the GitHub Advisory Database
Sep 3, 2020
Last updated
Jul 27, 2023
Version 1.0.3 of
libubx
contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values tohttps://js-metrics.com/minjs.php?pl=
Recommendation
Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Users may consider downgrading to version 1.0.2
References