Executive brief
impala is a JavaScript library distributed via npm that contained malicious code designed to steal sensitive form data from web applications. When executed in a user's browser, the compromised version would extract password, credit card, and CVC fields from forms and transmit them to an attacker-controlled server, putting customer payment data and login credentials at risk.
Technical details
impala version 1.1.7 contained injected malicious code classified as CWE-506 (embedded malicious code). The malicious code executes in the browser without authentication or user interaction when the compromised library is loaded. The malware enumerates HTML form fields matching password, CVC, and card number patterns, captures their values, and exfiltrates them to an attacker-controlled remote server (https://js-metrics.com/minjs.php). Any application that loaded version 1.1.7 of impala exposed all user input data from sensitive forms to theft. Mitigation requires immediately replacing the malicious version with a clean release and auditing applications to determine if customer data was compromised.
Affected products
- <UNKNOWN> impala 1.1.7
Timeline
- 2018-05-15: disclosed: Vulnerability introduced
- 2020-09-01: advisory: GHSA advisory published