Executive brief
A popular JavaScript library package contained malicious code designed to steal sensitive information from web forms, including login credentials and payment card data. When loaded in a user's browser, the compromised version (1.0.2) would capture and transmit this data to an attacker-controlled server. Organizations using this package must immediately remove it and assess whether customer or employee data was exposed.
Technical details
The npm package css_transform_support version 1.0.2 contained malicious injected code that hooks into browser form submission to enumerate and exfiltrate sensitive fields (password, cvc, cardnumber) to https://js-metrics.com/minjs.php via HTTP GET parameters. The attack requires no authentication and exploits the trust relationship between web applications and their dependencies. The code executes automatically when the malicious package is loaded in the browser context, potentially affecting all users of applications that depend on this version. The vulnerability was detected and isolated to version 1.0.2; users should downgrade to 1.0.1 or upgrade to a patched version.
Affected products
- npm css_transform_support 1.0.2
Timeline
- 2020-09-01: disclosed: Vulnerability published in GitHub Advisory Database
- 2020-08-31: other: GitHub security team reviewed and confirmed malicious code