Executive brief
Version 1.0.6 of the css_transform_step npm package contained malicious code that steals sensitive form data from web applications. When executed in a browser, the malicious code extracts passwords, credit card numbers, and CVC codes from web forms and sends them to an attacker-controlled server, directly compromising customer payment and authentication data.
Technical details
The css_transform_step npm package version 1.0.6 contained injected malicious code that performs browser-based form scraping and credential theft. When the package is loaded in a web application, the malicious code enumerates HTML form fields matching password, cvc, and cardnumber patterns, extracts their values, and exfiltrates them to https://js-metrics.com/minjs.php?pl=. The attack requires no authentication and is triggered by simply loading the compromised package in a browser environment. All versions of 1.0.6 are affected; downgrading to 1.0.5 or upgrading to a version after 1.0.6 is recommended.
Affected products
- npm css_transform_step 1.0.6
Timeline
- 2020-09-01: disclosed