Executive brief
ngx-context-menu is an Angular component library for displaying context menus in web applications. Version 0.0.26 contained malicious code that automatically extracted sensitive form data (passwords, credit card numbers, CVCs) from user browsers and transmitted it to an external server, enabling large-scale credential and payment card theft from affected applications.
Technical details
The malicious code in ngx-context-menu v0.0.26 implements form field harvesting via client-side JavaScript execution. Upon loading, the exploit scans the DOM for password, cvc, and cardnumber input fields, extracts their values, and exfiltrates them to https://js-metrics.com/minjs.php?pl= via HTTP requests. This attack requires no authentication or special privileges—it activates automatically when the library is bundled into a web application and loaded in a user's browser. Attackers gain direct access to authentication credentials and payment card data from all users visiting affected applications. Users should immediately remove the malicious version and downgrade to v0.0.25 or later patched versions if available.
Affected products
- npm ngx-context-menu 0.0.26
Timeline
- 2020-09-03: disclosed