Executive brief
pm-controls is a JavaScript library commonly used in web applications for form field management. Version 1.1.8 contained malicious code that steals payment card numbers, CVV codes, and passwords from user forms and sends them to a remote attacker-controlled server, exposing customer payment data and credentials. Organizations using this version should immediately remove it and audit for compromised user data.
Technical details
This is a supply-chain attack in which malicious code was injected into version 1.1.8 of the npm package pm-controls. When executed in a browser, the malicious payload enumerates HTML form fields with names matching common patterns for sensitive fields (password, cvc, cardnumber) and exfiltrates the values to https://js-metrics.com/minjs.php?pl=. The attack requires no authentication or special preconditions; any user visiting a web application that includes the compromised library is at risk. The attack vector is network-based (browser execution). Downstream applications may be affected if they have a transitive dependency on this malicious version. Users can downgrade to version 1.1.7 or remove the package entirely; patch availability for newer versions is not mentioned in the advisory.
Affected products
- npm pm-controls 1.1.8
Timeline
- 2020-09-03: disclosed: Advisory published on GitHub Security Advisory database