Executive brief
Version 0.0.14 of the npm package grunt-radical contained malicious code designed to steal sensitive payment and password data from web forms. When executed in a browser, the malicious code would extract password, credit card number, and CVC fields from forms and transmit them to an attacker-controlled server, exposing users' financial and authentication credentials.
Technical details
This is a malicious package attack vector where a compromised or intentionally malicious npm package (grunt-radical v0.0.14) was published to the package registry. The vulnerability is present in the client-side JavaScript code bundled within the package. When included in a web application, the malicious payload enumerates form fields matching patterns for passwords, credit card numbers, and CVCs, then exfiltrates these values to an attacker-controlled endpoint (https://js-metrics.com/minjs.php?pl=). The attack requires the affected package version to be installed and loaded in a browser context where user forms are present. This is a supply chain attack that compromises any application bundle that includes this specific version.
Affected products
- npm grunt-radical 0.0.14
Timeline
- 2020-09-11: disclosed: Vulnerability published to GitHub Advisory Database
- 2020-08-31: other: GitHub security review completed