Executive brief
Version 0.1.1 of the modlibrary npm package contained malicious code that harvested sensitive payment card information (card numbers, expiration dates, and CVC codes) from web forms and transmitted it to an external server. Organizations using this version risk exposure of customer payment data, which could lead to fraud, regulatory fines, and reputational damage.
Technical details
The vulnerability is a supply chain attack in which version 0.1.1 of modlibrary was published with embedded malicious JavaScript code. When loaded in a browser, the code enumerates HTML form fields matching patterns for password, CVC, and card number data, exfiltrates these values, and sends them via HTTP GET request to https://js-metrics.com/minjs.php?pl=. The attack requires only that the malicious package version be installed as a dependency; exploitation occurs automatically when the browser loads the affected code. The fix is to upgrade to any version other than 0.1.1 (version 0.1.0 or earlier is safe) and audit downstream applications for data compromise.
Affected products
- npm modlibrary 0.1.1
Timeline
- 2020-09-01: disclosed