A critical information exposure vulnerability in the eslint-ban-moment plugin risks the compromise of sensitive database credentials stored in configuration files.

The plugin improperly handles configuration data, resulting in the exposure of a Supabase URI containing plaintext usernames and passwords (CWE-260). This vulnerability is exploitable by an unauthenticated remote attacker.

The exposure of database credentials (CVSS 9.8) grants an attacker unauthorized access to the underlying Supabase backend. This could lead to a full breach of data confidentiality, unauthorized modification of records, or total administrative takeover of the database, posing significant risks to data privacy and regulatory compliance.

Immediate Action: Audit existing .env files for exposed credentials and rotate any Supabase keys that may have been included in previous project configurations.

Proactive Monitoring: Scan source code repositories and deployment environments for hardcoded secrets and monitor database logs for suspicious access patterns.

Compensating Controls: Use secret management services (e.g., HashiCorp Vault, AWS Secrets Manager) instead of local .env files and implement environment-level access controls.

Public Exploit Available: Unknown

Given the critical severity of this credential exposure, immediate remediation is required. Users must rotate all potentially compromised credentials and transition to secure secret management practices to mitigate the risk of unauthorized database access.