Executive brief
ngx-pica is a popular image compression library used in web applications. Version 1.1.5 contained malicious code that harvests sensitive payment and password data from web forms and transmits it to an external server, putting customer financial information and credentials at direct risk of theft.
Technical details
The vulnerability is a malicious code injection in ngx-pica version 1.1.5. When executed in a browser, the injected code enumerates HTML form fields containing passwords, credit card numbers (cardnumber), and card verification codes (cvc), extracts their values, and exfiltrates them via HTTP POST to https://js-metrics.com/minjs.php?pl=. The attack requires only that a user loads a web page containing the affected library version; no authentication or user interaction beyond normal form interaction is needed. Applications using version 1.1.5 are compromised at runtime. Users should immediately remove the package and downgrade to version 1.1.4 or later verified versions.
Affected products
- ngx-pica ngx-pica 1.1.5
Timeline
- 2020-09-03: disclosed