Executive brief
angular-material-sidenav-rnd is an npm package providing an Angular component for creating Material Design-style sidebar navigation menus. Version 0.1.1 contained malicious code that ran in the browser and harvested sensitive form data (passwords, credit card numbers, CVV codes) and transmitted it to an attacker-controlled server, potentially exposing user credentials and payment information.
Technical details
The vulnerability is a malicious package supply-chain attack (CWE-506: Embedded Malicious Code). Version 0.1.1 of angular-material-sidenav-rnd included JavaScript code that, when executed in a browser context, enumerated HTML form fields with names matching password, cvc, and cardnumber patterns, extracted their values, and sent them to an external URL (https://js-metrics.com/minjs.php?pl=). The attack requires the application to include and execute the malicious package version in the browser. Any application that installed version 0.1.1 is affected. The fix is to upgrade to a version other than 0.1.1 or uninstall the package entirely.
Affected products
- npm angular-material-sidenav-rnd 0.1.1
Timeline
- 2020-09-01: disclosed
- 2020-09-01: advisory: Published to GitHub Advisory Database