Executive brief
angular-bmap is a popular JavaScript library used in web applications to interact with Baidu Maps. Version 0.0.9 contained malicious code that automatically harvested sensitive payment information (credit card numbers, CVC codes, and passwords) from web forms and transmitted this data to a remote server, exposing users' financial credentials to attackers.
Technical details
This is a supply-chain attack involving a malicious package uploaded to npm. Version 0.0.9 of angular-bmap contained injected code that executes in the browser and harvests sensitive payment form fields (password, cvc, cardnumber) and exfiltrates them via HTTP POST to https://js-metrics.com/minjs.php. The attack requires no authentication or special privileges—any application that included the compromised package version would automatically execute the malicious code client-side when the library is loaded. The vulnerability affects the entire package version 0.0.9; users should immediately remove this version and audit applications and logs to determine if financial data was compromised.
Affected products
- npm angular-bmap 0.0.9
Timeline
- 2018-05-15: disclosed: Malicious package introduced
- 2020-09-01: advisory: GHSA-w8hg-mxvh-9h57 published