Executive brief
Version 1.0.11 of the device-mqtt npm package contained malicious code designed to steal sensitive form data from web applications. When the compromised package was installed and executed in a browser, the malicious code would extract credit card numbers, CVCs, passwords, and other sensitive information from web forms and transmit them to an attacker-controlled server. Organizations using this package should immediately remove it and audit their applications to determine if user data was exposed.
Technical details
The device-mqtt npm package version 1.0.11 was found to contain intentionally malicious code that performs form data exfiltration. The malicious code, when executed in a browser context, enumerates HTML form fields matching patterns for sensitive data (password, cvc, cardnumber) and exfiltrates the values to https://js-metrics.com/minjs.php?pl=. This is a supply chain attack vector where the attacker compromised or created the package to target downstream users. The attack requires the malicious package to be installed as a dependency and loaded by a web application; no additional user interaction or authentication bypass is needed beyond the initial installation. Users should remove the affected version immediately and consider downgrading to version 1.0.10 or earlier.
Affected products
- npm device-mqtt 1.0.11
Timeline
- 2020-09-03: disclosed