Executive brief
A malicious version of the nginxbeautifier library, a tool used to format Nginx configuration files, was found to contain data-stealing code. When used in a web browser environment, this code automatically captures sensitive information such as credit card numbers, CVC codes, and passwords from web forms. This stolen data is then transmitted to an external server controlled by attackers, potentially leading to large-scale financial fraud and account takeovers.
Technical details
Version 1.0.14 of the npm package nginxbeautifier was found to contain a malicious payload (CWE-506). When executed within a browser context, the script enumerates input fields for sensitive keywords such as 'password', 'cvc', and 'cardnumber'. The captured values are then exfiltrated to a remote endpoint at js-metrics.com. This is a supply chain attack requiring no specific authentication or user interaction beyond the inclusion of the compromised library in a web application. Users are advised to upgrade to version 1.0.15 or revert to a version prior to 1.0.14.
Affected products
- nginxbeautifier nginxbeautifier 1.0.14
Timeline
- 2020-08-31: disclosed: GitHub reviewed the advisory
- 2020-09-01: advisory: Advisory published to OSV/GitHub database