dynamo-schema malicious package exfiltrating form data

Executive brief

dynamo-schema is a Node.js module for validating Amazon DynamoDB data models. Version 0.0.3 contained malicious code that would harvest sensitive form fields (passwords, credit card numbers, CVCs) from web pages and transmit them to an attacker-controlled server, leading to complete compromise of user credentials and payment card data.

Technical details

This is a case of intentional malicious code injection (CWE-506) in a published npm package. When executed in a browser context, version 0.0.3 would enumerate HTML form elements looking for password, cvc, and cardnumber fields, extract their values, and exfiltrate them via HTTP requests to https://js-metrics.com/minjs.php. The attack requires no authentication and no user interaction—simply including the malicious package in a web application enabled data theft. Patch availability: versions before or after 0.0.3 are safe.

Affected products

• npm dynamo-schema 0.0.3

Timeline

• 2020-09-01: disclosed
• other: Malicious code introduced in version 0.0.3

References

• https://github.com/andrewjstone/dynamo-schema
• https://snyk.io/vuln/SNYK-JS-DYNAMOSCHEMA-450992