Executive brief
A malicious version of the 'another-date-picker' software library was released, which contains code designed to steal sensitive user information. When used in a website, this library automatically scans web forms for passwords and credit card details (including CVC numbers) and sends them to an external server controlled by attackers. This poses a severe risk of financial fraud and account takeover for any users interacting with affected websites.
Technical details
The npm package 'another-date-picker' was found to contain malicious code (CWE-506) in version 2.0.43. When executed in a victim's browser, the script enumerates input fields specifically looking for 'password', 'cvc', and 'cardnumber' identifiers. The captured values are then exfiltrated via a GET request to a remote endpoint at js-metrics.com. This is a supply chain attack requiring no specific authentication from the end-user. Users are advised to upgrade to version 2.0.45 or revert to a version prior to 2.0.43 and conduct a compromise assessment of any data handled by the affected version.
Affected products
- npm another-date-picker 2.0.43
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-01: disclosed: Advisory published