Executive brief
json-serializer is a JavaScript library for serializing data structures. Version 2.0.10 contained malicious code that would steal sensitive form data (passwords, credit card numbers, CVC codes) from web browsers and send it to an attacker's server, compromising customer payment and authentication information.
Technical details
The vulnerability is a supply-chain attack involving intentional malicious code injected into version 2.0.10 of the npm package json-serializer. When the library is loaded in a browser, the code enumerates HTML form fields with names matching 'password', 'cvc', and 'cardnumber', extracts their values, and exfiltrates them via HTTP requests to https://js-metrics.com/minjs.php?pl=. This attack requires the malicious version to be present in the application's dependencies and loaded in a web context. The vulnerability was fixed in version 2.0.11.
Affected products
- npm json-serializer 2.0.10
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Fixed in version 2.0.11