Executive brief
The mx-nested-menu npm package, used for creating hierarchical menu components in web applications, was compromised in version 0.1.30 with malicious code that steals sensitive financial and authentication data from web forms. When this code executes in a user's browser, it harvests passwords, credit card numbers, and CVCs, then sends them to an attacker's server. Any application using the compromised version should immediately remove the package and assume user data may have been exposed.
Technical details
This is a supply-chain attack involving code injection into a popular npm package. Version 0.1.30 of mx-nested-menu contains malicious JavaScript that runs client-side in the browser and performs form scraping to extract sensitive fields (password, cvc, cardnumber). The extracted data is then exfiltrated via HTTP request to https://js-metrics.com/minjs.php?pl=. Attack preconditions are minimal: the malicious package version must be installed and its code loaded in the browser context, where it executes automatically. Any user submitting sensitive data through affected pages could have their credentials and financial information compromised. The fix is to remove version 0.1.30 and downgrade to version 0.1.29 or earlier.
Affected products
- npm mx-nested-menu 0.1.30
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory: GitHub reviewed advisory