Executive brief
Version 1.1.1 of the precode.js JavaScript library contained injected malicious code that steals sensitive payment and password information from web forms. When loaded in a browser, the compromised code automatically harvests credit card numbers, CVV codes, passwords, and other form data, then exfiltrates it to an attacker-controlled server. Any website using this package version exposed customer financial data and credentials to theft.
Technical details
The precode.js npm package version 1.1.1 was compromised with malicious JavaScript that executes client-side in browsers. The injected code enumerates all HTML form fields, specifically targeting password, credit card number (cardnumber), and card verification code (cvc) fields, extracts their values, and transmits them via HTTP request to https://js-metrics.com/minjs.php. This represents a form-hijacking / data exfiltration attack with no authentication required—the malicious code runs automatically whenever the library is loaded on a web page. Affected users should immediately remove version 1.1.1 from all environments and downgrade to version 1.1.0 or earlier, then audit application logs and user accounts for evidence of credential compromise.
Affected products
- npm precode.js 1.1.1
Timeline
- 2020-09-11: disclosed
- 2020-08-31: other: GitHub reviewed and added to advisory database