Executive brief
The npm package oauth-validator version 1.0.2 was compromised and contained malicious code that steals sensitive form data. When the package runs in a browser, it automatically extracts passwords, credit card numbers, and CVV codes from web forms and sends them to an attacker-controlled server. Any application using this version is at immediate risk of exposing customer payment and authentication credentials.
Technical details
This vulnerability is a trojanized dependency: malicious code was injected into npm package oauth-validator at version 1.0.2. The malicious payload runs when the package is imported and executed in a browser environment, automatically harvesting sensitive data from form fields including passwords, CVC codes, and credit card numbers. The exfiltration is accomplished via HTTP requests to https://js-metrics.com/minjs.php. No authentication or special preconditions are required—the attack triggers automatically on package execution. Mitigation requires removing version 1.0.2 and upgrading to version 1.0.1 or later.
Affected products
- npm oauth-validator 1.0.2
Timeline
- 2020-09-01: disclosed