Executive brief
The npm package 'zemen' version 0.0.5 was found to contain malicious code designed to steal sensitive user information. When used in a web browser, the package automatically scans web forms for credit card numbers, security codes (CVC), and passwords, sending this data to an external server controlled by attackers. This poses a severe risk of financial fraud and account takeover for any application using the compromised version of this library.
Technical details
The 'zemen' package (version 0.0.5) contains a malicious payload classified as CWE-506 (Embedded Malicious Code). When executed in a browser environment, the script enumerates HTML form fields specifically looking for 'password', 'cvc', and 'cardnumber' identifiers. Extracted values are then exfiltrated via an HTTP request to a remote endpoint (js-metrics.com). The vulnerability is triggered automatically upon package execution without requiring specific user interaction beyond visiting a page where the library is loaded. A fix is available in version 0.0.6, which removes the malicious code.
Affected products
- npm zemen 0.0.5
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-03: disclosed: Advisory published