Executive brief
Version 1.0.3 of the bmap npm package contained malicious code that steals sensitive form data from websites using the library. When a web page loads this compromised version, the code automatically harvests password, credit card number, and CVC fields from forms and transmits them to an attacker-controlled server, putting user credentials and payment information at risk.
Technical details
This is a supply-chain attack where malicious code was injected into the bmap npm library (version 1.0.3). The injected payload executes in the browser context when the package is imported, scans the DOM for form fields matching common names for passwords, credit card numbers, and CVCs, and exfiltrates the values via HTTP POST to https://js-metrics.com/minjs.php?pl=. The attack requires only that the compromised package version be installed and loaded by a web application; no special preconditions or user interaction beyond normal browsing is needed. Affected websites lose control over sensitive customer data. The fix is to remove version 1.0.3 and upgrade to an earlier or later version.
Affected products
- npm bmap 1.0.3
Timeline
- 2020-09-03: disclosed: OSV/GHSA published