Executive brief
Version 4.1.48 of the another-date-range-picker JavaScript library, used to provide date selection functionality in web applications, contained malicious code that steals sensitive form data. When loaded in a browser, the malicious code extracts credit card numbers, security codes, and password fields from web forms and transmits them to an attacker-controlled server, exposing customer payment and authentication data.
Technical details
This vulnerability involves malicious code injection in a JavaScript library distributed via npm. The compromised version 4.1.48 of another-date-range-picker contains client-side code (CWE-506: Embedded Malicious Code) that executes in the browser when the library is loaded. The malicious payload enumerates HTML form fields for sensitive data (password, cvc, cardnumber) and exfiltrates captured values to a remote server at https://js-metrics.com/minjs.php?pl=. The attack requires no authentication and affects any web application using the vulnerable version. Applications should upgrade to any version other than 4.1.48 and conduct forensic analysis to determine if customer data was compromised during the window of exposure.
Affected products
- npm another-date-range-picker 4.1.48
Timeline
- 2020-09-01: disclosed