Executive brief
freshdom is a popular JavaScript library used for creating user interfaces in web applications. Version 0.0.6 contained malicious code that automatically harvested sensitive data (passwords, credit card numbers, and security codes) from web forms and transmitted them to an attacker-controlled server, exposing any user data entered into applications using the compromised package.
Technical details
This is a malicious package vulnerability (CWE-506) in the npm library freshdom version 0.0.6. The malicious code executes in the browser context and enumerates form fields matching password, CVC, and card number patterns, then exfiltrates the entered values via HTTP to a remote endpoint (js-metrics.com/minjs.php). The attack requires no authentication, user interaction, or special privileges—it triggers automatically when the library is loaded in any web page. The vulnerability affects only version 0.0.6; users should upgrade to any other version.
Affected products
- freshdom freshdom 0.0.6
Timeline
- 2018-05-15: disclosed: Malicious code introduced
- 2020-09-01: advisory