Executive brief
blingjs is a JavaScript DOM manipulation library commonly used in web applications. Version 0.0.4 contained malicious code that would extract sensitive payment card information (card numbers, CVCs, passwords) from web forms and transmit this data to an attacker-controlled server. This represents a direct threat to customer data security and financial fraud risk for any organization using the compromised version.
Technical details
This is a supply-chain attack involving malicious code injection into a legitimate npm package (CWE-506: Embedded Malicious Code). Version 0.0.4 of blingjs contained code that, when executed in a browser, enumerated form fields matching payment-sensitive patterns (password, CVC, cardnumber) and exfiltrated their values via HTTP requests to https://js-metrics.com/minjs.php. The attack vector is network-based with no authentication or user interaction required—any browser loading a page that includes the malicious library would execute the code. The impact is total compromise of confidentiality, integrity, and availability of sensitive form data. Versions outside 0.0.4 are unaffected; patching requires immediate removal and replacement with a safe version.
Affected products
- blingjs blingjs 0.0.4
Timeline
- 2018-05-15: disclosed: Vulnerability introduced and disclosed
- 2020-09-01: advisory: GHSA advisory published