Executive brief
Version 1.0.1 of leaflet-gpx, a popular JavaScript library for rendering GPS tracks on web maps, contained malicious code that steals payment card and password information from web forms. When the compromised library was loaded in a user's browser, it would capture sensitive data from form fields and transmit them to an attacker-controlled server, putting any website using this version at risk of exposing customer payment and authentication credentials.
Technical details
This is a malicious package compromise where version 1.0.1 of the leaflet-gpx npm library was seeded with form-harvesting malware. The malicious code executes in the browser context when the library is imported and automatically enumerates form fields matching password, cvc (card verification code), and cardnumber patterns, then exfiltrates the captured values via HTTP POST to an attacker-controlled domain (js-metrics.com/minjs.php). The attack requires no user interaction—merely including the compromised version in a web application's dependencies exposes all visitors to credential theft. No authentication or special privileges are required. The package has been removed from distribution and users should downgrade to version 1.0.0 or remove the package entirely.
Affected products
- leaflet-gpx leaflet-gpx 1.0.1
Timeline
- 2020-09-03: disclosed
- 2020-08-31: other: GitHub advisory review date