Executive brief
A malicious version of the ember-power-timepicker library, a component used for selecting times in web applications, was found to contain data-stealing code. When a user interacts with a website using this compromised version, the library automatically captures sensitive information such as passwords and credit card details from forms. This stolen data is then sent to an external server controlled by attackers, leading to potential identity theft and financial fraud for your customers.
Technical details
Version 1.0.8 of the npm package ember-power-timepicker was identified as a malicious release. The package contains JavaScript that executes in the victim's browser to scan for and enumerate input fields labeled for passwords, CVC codes, and credit card numbers. Once captured, these values are exfiltrated via an HTTP request to a third-party domain (js-metrics.com). This is a supply chain attack requiring no specific authentication from the end-user. Users are advised to remove the package or downgrade to version 1.0.7 immediately.
Affected products
- npm ember-power-timepicker 1.0.8
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-11: disclosed: Advisory published