Executive brief
The npm package 'codify', a utility for converting integers to base36 codes, was found to contain malicious code in version 0.3.1. When used in a web browser, this malicious code automatically scans for sensitive input fields such as passwords and credit card details (CVC and card numbers). Any captured data is then transmitted to a remote server controlled by the attacker, leading to potential large-scale theft of customer financial information and credentials.
Technical details
The 'codify' package version 0.3.1 contains a malicious payload (CWE-506) that executes within the context of a user's browser. The script is designed to enumerate HTML form fields specifically targeting 'password', 'cvc', and 'cardnumber' attributes. Once sensitive data is entered into these fields, the package exfiltrates the values via a GET request to a remote endpoint (https://js-metrics.com/minjs.php). This is a supply chain attack requiring no specific authentication or user interaction beyond the application loading the compromised library. Users are advised to downgrade to a version prior to 0.3.1 or upgrade to a clean version if available.
Affected products
- bozuko codify 0.3.1
Timeline
- 2018-05-15: disclosed: Vulnerability disclosed and malicious version introduced
- 2019-06-26: advisory: Snyk advisory published
- 2020-09-01: advisory: GitHub advisory published