Executive brief
json-serializer is a JavaScript library used to serialize data structures in web applications. Version 2.0.10 contained malicious code that, when executed in a browser, extracts sensitive information from web forms (passwords, credit card numbers, CVV codes) and sends it to an attacker-controlled server, compromising user data and payment card information.
Technical details
A malicious npm package (json-serializer version 2.0.10) was published containing obfuscated code that runs in the browser context. The exploit enumerates HTML form fields with names matching password, cvc, and cardnumber patterns, extracts their values, and transmits them to https://js-metrics.com/minjs.php?pl=. This attack requires no user interaction beyond visiting a page that loads the compromised library version. The vulnerability affects only version 2.0.10; upgrading to 2.0.11 or downgrading to earlier versions resolves the issue. Applications using the malicious version should be audited for data compromise.
Affected products
- npm json-serializer 2.0.10
Timeline
- 2020-09-01: disclosed
- 2020-09-01: patched: fixed in version 2.0.11