Executive brief
Version 1.3.2 of geoheat, a JavaScript library for geographic data processing, contained intentionally injected malicious code. When executed in a web browser, the code would extract password, credit card number, and CVC fields from web forms and transmit them to an attacker-controlled server. Any application using this version would have exposed sensitive financial and authentication data from its users.
Technical details
This is a malicious package attack—an intentionally compromised library release. The malicious code was injected into version 1.3.2 of the geoheat npm package and executes client-side in the browser. The payload performs DOM scanning to identify HTML form fields with names/attributes matching "password", "cvc", and "cardnumber", extracts their values, and exfiltrates them to an attacker-controlled endpoint (js-metrics.com). No authentication or user interaction is required; the attack occurs automatically upon page load for any site including the vulnerable library. The only mitigation is immediate removal of version 1.3.2 and downgrade to 1.3.1 or earlier.
Affected products
- geoheat geoheat 1.3.2
Timeline
- 2020-09-11: disclosed