Executive brief
The dossier npm package version 0.0.4 contained malicious code that would automatically identify password, credit card, and CVC fields in web forms, capture the entered values, and transmit them to an attacker-controlled server. Any website using this compromised package version would expose sensitive customer financial and authentication data without the knowledge of the site operator or users.
Technical details
The dossier npm package (CWE-506: Embedded Malicious Code) version 0.0.4 contained intentionally malicious code that executes within the browser context of any application using it. When loaded, the malicious code enumerates HTML form fields named or styled as password, CVC, and card number, extracts values entered by users, and exfiltrates them to a remote server (js-metrics.com/minjs.php). No authentication, elevated privileges, or user interaction is required to exploit this—the payload executes automatically upon package import. Any website or application that included dossier 0.0.4 as a dependency would leak customer payment and authentication credentials. The attack is network-based with low complexity and no preconditions, resulting in total compromise of confidentiality, integrity, and availability within the vulnerable component's scope.
Affected products
- npm dossier 0.0.4
Timeline
- 2020-09-01: disclosed: Published to GitHub Advisory Database