Executive brief
grunt-radic is a JavaScript build tool plugin. Version 0.1.1 contained malicious code that steals payment card data and passwords from web forms, exfiltrating this sensitive customer information to an external server. Organizations using this compromised version must immediately remove it and review whether customer data was exposed.
Technical details
The vulnerability is a trojanized/malicious package injection in grunt-radic version 0.1.1. When executed in a browser environment, the injected code enumerates HTML form fields named "password", "cvc", and "cardnumber", extracts their values, and transmits them to an attacker-controlled server (https://js-metrics.com/minjs.php) via HTTP GET requests. The attack is passive—it requires only that the malicious package be installed and its code executed in a web context. No authentication or special privileges are needed. The primary impact is theft of payment card data and credentials from users interacting with the compromised application. Version 0.1.0 is reported as safe; affected users should downgrade or remove the package entirely.
Affected products
- grunt-radic grunt-radic 0.1.1
Timeline
- 2020-09-11: disclosed