Executive brief
The npm package 'cal_rd' was found to contain malicious code designed to steal sensitive user information. When used in a web application, the library monitors browser forms for credit card numbers, security codes (CVC), and passwords, sending this data to an external server controlled by attackers. This poses a severe risk of financial fraud and account takeover for any users interacting with applications that include this library.
Technical details
The npm package 'cal_rd' (specifically version 0.1.1 and potentially others) contains a malicious payload classified as CWE-506 (Embedded Malicious Code). When executed within a victim's browser, the script enumerates input fields specifically looking for 'password', 'cvc', and 'cardnumber' attributes. The captured sensitive data is then exfiltrated via an HTTP GET request to a malicious endpoint at js-metrics.com. This is a supply-chain attack requiring no authentication from the end-user. Users are advised to completely remove the package and audit their systems for potential data compromise.
Affected products
- npm cal_rd All versions up to 0.1.1
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-03: disclosed: Advisory published to OSV database