Executive brief
dictum.js is a JavaScript library distributed via npm. Version 1.0.5 contained malicious code that steals sensitive payment and authentication information (passwords, card numbers, CVV codes) from web forms and transmits it to a remote attacker-controlled server. Organizations using this compromised version face immediate risk of customer data theft and credential exposure.
Technical details
The vulnerability is a supply-chain attack in the form of malicious code injection. Version 1.0.5 of the dictum.js npm package contained code that, when executed in a browser context, enumerates HTML form fields matching password, CVC, and card number patterns, extracts their values, and exfiltrates them to an external attacker-controlled endpoint (https://js-metrics.com/minjs.php?pl=). The attack vector is network-based and requires no authentication; any user visiting a web application that loads the compromised library version is vulnerable. The payload executes automatically in the browser without user interaction, allowing wholesale theft of sensitive form data. Users should immediately replace version 1.0.5 with version 1.0.4 or earlier, and audit their applications and user data for compromise.
Affected products
- npm dictum.js 1.0.5
Timeline
- 2020-09-01: disclosed
- 2020-08-31: advisory