Executive brief
A malicious version of the 'coffee-project' software library was released, containing code designed to steal sensitive user information. When used in a web application, this library automatically captures credit card details and passwords entered by customers and sends them to an external server controlled by attackers. This poses a severe risk of financial fraud and data breaches for any organization using the affected version.
Technical details
Version 1.7.5 of the npm package 'coffee-project' was found to contain a malicious payload. When executed within a browser environment, the script automatically enumerates HTML form fields specifically looking for sensitive identifiers such as 'password', 'cvc', and 'cardnumber'. The captured data is then exfiltrated via an HTTP request to a third-party domain (js-metrics.com). This is a supply chain attack requiring no specific authentication from the end-user. Users are advised to downgrade to version 1.7.4 or audit their environments for the presence of the compromised version.
Affected products
- coffee-project coffee-project 1.7.5
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-01: disclosed: Advisory published