Executive brief
A malicious version of the motiv.scss library was identified that contains code designed to steal sensitive user information. When a website using this library is loaded in a browser, the malicious code automatically scans for credit card numbers, security codes (CVC), and passwords entered into forms. This stolen data is then transmitted to an external server controlled by attackers, potentially leading to widespread financial fraud and account takeovers.
Technical details
The npm package motiv.scss version 0.4.20 was found to contain a malicious payload (CWE-506). When executed within a victim's browser, the script enumerates HTML form fields specifically looking for 'password', 'cvc', and 'cardnumber' identifiers. The captured plaintext values are then exfiltrated via an HTTP request to a remote endpoint at js-metrics.com. This is a supply chain attack requiring no authentication or specific user interaction beyond visiting a site where the library is deployed. The issue was addressed in version 0.4.21, which removed the malicious code.
Affected products
- npm motiv.scss 0.4.20
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-11: disclosed: Advisory published