Executive brief
@impala/bmap is a JavaScript library distributed through npm. Version 1.0.3 contained malicious code that, when executed in a web browser, would harvest sensitive payment and authentication data (passwords, credit card numbers, CVC codes) from web forms and transmit them to an attacker-controlled remote server. Applications using this version could have exposed customer financial and login credentials.
Technical details
This vulnerability is embedded malicious code (CWE-506) in an npm package. Version 1.0.3 of @impala/bmap contains client-side JavaScript that enumerates HTML form fields containing passwords, credit card numbers, and CVC values, then exfiltrates these values to a remote attacker-controlled endpoint (https://js-metrics.com/minjs.php?pl=). The malicious code executes immediately upon the library being loaded in a browser, with no authentication or user interaction required beyond the victim visiting a web application that includes this dependency. Any application bundling this specific version would expose all user payment and authentication credentials to the attacker. No patched versions have been identified; remediation requires removing version 1.0.3 entirely and replacing it with an uncompromised version.
Affected products
- npm @impala/bmap 1.0.3
Timeline
- 2020-09-01: disclosed: Published to GitHub Advisory Database
- 2019-06-26: other: Disclosed according to Snyk records