Executive brief
Version 0.0.3 of the jasmin JavaScript library contained malicious code that steals sensitive payment card information. When executed in a web browser, the code extracts payment card numbers, expiration dates (CVC), and password fields from web forms and transmits them to an external attacker-controlled server, putting users' financial and account data at risk.
Technical details
The jasmin npm package version 0.0.3 contained intentionally injected malicious code designed to harvest sensitive form data. The attack works through client-side JavaScript execution in the browser, where the code enumerates HTML form fields matching password, CVC, and credit card number patterns, then exfiltrates the extracted values via HTTP requests to https://js-metrics.com/minjs.php. No authentication or special preconditions are required—the malicious payload activates automatically when the library is loaded in any web page. Affected versions should be immediately replaced with 0.0.2 or later patched releases (not 0.0.3).
Affected products
- npm jasmin 0.0.3
Timeline
- 2020-09-01: disclosed