Executive brief
github-jquery-widgets is a JavaScript library used to enhance web application functionality. Version 0.1.2 contained malicious code that steals sensitive form data (passwords, credit card numbers, and CVV codes) from end-user browsers and transmits it to an external server, creating a direct risk of customer credential and payment card compromise.
Technical details
This is a supply-chain attack delivered via a malicious npm package. The vulnerable component (version 0.1.2) contains injected JavaScript that executes in the browser context with no authentication or special privileges required—it runs automatically when the package is loaded. The malicious payload enumerates password, cvc, and cardnumber fields from HTML forms and exfiltrates the values to https://js-metrics.com/minjs.php via HTTP GET request. Any application that included this package version would immediately expose end-user sensitive data. The fix is to remove the package entirely or downgrade to version 0.1.1.
Affected products
- npm github-jquery-widgets 0.1.2
Timeline
- 2020-09-11: disclosed