Executive brief
awesome_react_utility is an npm library used by JavaScript developers in web applications. Version 1.0.2 contained malicious code that harvested sensitive form data—including passwords, credit card numbers, and CVCs—and exfiltrated them to an external server, putting customer payment data and credentials at risk.
Technical details
The vulnerability is code injection via a compromised npm package. Version 1.0.2 of awesome_react_utility contained malicious JavaScript that enumerates form fields with names matching password, cvc, and cardnumber patterns, extracts their values, and transmits them to https://js-metrics.com/minjs.php. The attack occurs at runtime in the browser with no authentication or special privileges required; any application using the malicious version executes the code automatically. The impact is exfiltration of sensitive authentication and payment card data from end users. The fix is to avoid version 1.0.2 entirely and use an earlier or later release.
Affected products
- npm awesome_react_utility 1.0.2
Timeline
- 2020-09-01: disclosed
- 2020-08-31: advisory: GitHub reviewed and published advisory GHSA-m25q-fwg4-9v2p