Executive brief
libubx is a JavaScript library published on npm. Version 1.0.3 contained deliberately injected malicious code that harvests sensitive payment card data (card numbers, CVV, and passwords) from web forms and transmits them to an attacker-controlled server. Any application using this compromised version risks exposing customer financial and login credentials.
Technical details
The vulnerability is a supply-chain attack via a deliberately malicious package distribution. Version 1.0.3 of libubx contained injected JavaScript code that, when executed in a browser, enumerates form fields matching common payment and authentication patterns (password, cvc, cardnumber) and exfiltrates their values to https://js-metrics.com/minjs.php?pl=. The attack vector is network-based through normal package installation and script execution. No authentication or special preconditions are required—any website loading the compromised library in a browser context becomes a data harvesting vector. The affected version (1.0.3) should be immediately removed; version 1.0.2 and earlier are unaffected.
Affected products
- libubx libubx 1.0.3
Timeline
- 2020-09-03: disclosed