Executive brief
The npm package s3asy, version 0.4.8, was found to contain malicious code designed to steal sensitive user information. When used in a web application, this package would automatically scan for and capture passwords, credit card numbers, and security codes (CVC) entered by users into web forms. This stolen data was then transmitted to an external server controlled by the attacker, leading to potential identity theft and financial fraud for the application's customers.
Technical details
Version 0.4.8 of the s3asy npm package was identified as a malicious distribution. The package contains JavaScript code that, when executed in a browser environment, enumerates input fields such as 'password', 'cvc', and 'cardnumber' within HTML forms. The extracted values are then exfiltrated via an HTTP request to a remote endpoint at js-metrics.com. This is a supply chain attack targeting web applications that include this library as a dependency. Users are advised to downgrade to version 0.4.7 or audit their applications for data compromise.
Affected products
- npm s3asy 0.4.8
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory.
- 2020-09-01: disclosed: Advisory published.