Executive brief
Version 1.0.4 of iie-viz, an npm JavaScript library, contained malicious code that steals sensitive form data from web pages. When executed in a browser, the malicious code would identify and extract payment card information (card numbers, CVCs) and passwords from forms, then transmit this data to an attacker-controlled server. Organizations using this version face direct exposure of customer payment data and credentials.
Technical details
This is a supply-chain attack through a malicious npm package. The compromised version 1.0.4 of iie-viz injects form-scraping code that executes in the browser context when the library is loaded. The malicious payload enumerates HTML form fields matching patterns for password, CVC, and card number fields, exfiltrates the values to https://js-metrics.com/minjs.php, and transmits this data over the network to attacker infrastructure. No authentication or user interaction beyond loading an affected webpage is required. The vulnerability affects any web application that imported this specific version as a dependency. Downgrading to version 1.0.3 or removing the package is the recommended remediation.
Affected products
- npm iie-viz 1.0.4
Timeline
- 2020-09-03: disclosed