Executive brief
The angular-location-update npm package, used by web developers to handle location updates in Angular applications, was compromised in version 0.0.3 with malicious code that steals sensitive user data. When loaded in a user's browser, the code automatically harvests password fields, credit card numbers, and security codes from web forms and sends them to an attacker-controlled server. Any application that included this package version could have exposed customer payment and login credentials.
Technical details
This is a supply chain attack where malicious code was injected into version 0.0.3 of the angular-location-update npm package. The payload executes client-side in the browser and harvests form fields with names/attributes matching "password", "cvc", and "cardnumber", then exfiltrates the captured values via HTTP GET requests to https://js-metrics.com/minjs.php?pl=. The attack requires no authentication and affects all users of applications that bundled or loaded this package version. No patch was issued; remediation requires removing the package entirely or downgrading to version 0.0.2. This demonstrates the critical risk of malicious packages in popular open-source registries.
Affected products
- npm angular-location-update 0.0.3
Timeline
- 2020-09-11: disclosed: Advisory published; malicious version 0.0.3 identified