Executive brief
jquery-airload is a JavaScript library used in web applications to handle file uploads. Version 0.2.5 contained malicious code that steals sensitive form data—including passwords, credit card numbers, and verification codes—and transmits it to an external server. Applications using this compromised version expose all user credential and payment data to attackers.
Technical details
A malicious code injection in jquery-airload version 0.2.5 implements a form-scraping attack that enumerates password, CVC (card verification code), and cardnumber fields from DOM forms and exfiltrates the extracted values via HTTP GET requests to https://js-metrics.com/minjs.php. The attack requires no authentication and is executed client-side whenever the library is loaded in a browser. The malicious payload will harvest any sensitive form data present on the page. Users should immediately remove version 0.2.5 and consider downgrading to version 0.2.4 or removing the package entirely; affected applications should be audited for credential and payment card compromise.
Affected products
- npm jquery-airload 0.2.5
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory