Executive brief
A malicious version of the ng-ui-library package was identified that contains code designed to steal sensitive user information. When used in a web application, this library monitors payment forms to capture credit card numbers, security codes, and passwords, sending them to an external server controlled by attackers. This poses a severe risk of financial fraud and data breaches for any organization using the affected version.
Technical details
The npm package ng-ui-library version 1.0.987 was found to contain a malicious payload (CWE-506). When executed in a victim's browser, the script enumerates HTML form fields specifically looking for 'password', 'cvc', and 'cardnumber' identifiers. Captured data is exfiltrated via an HTTP GET request to a remote endpoint at js-metrics.com. This is a supply chain attack requiring no authentication or specific user interaction beyond visiting a site where the library is deployed. Users should upgrade to version 1.0.990 or remove the package entirely.
Affected products
- npm ng-ui-library 1.0.987
Timeline
- 2020-08-31: disclosed: GitHub reviewed the advisory
- 2020-09-11: advisory: Advisory published to OSV database