Executive brief
pyramid-proportion is a JavaScript library published to npm. Version 1.0.5 contained malicious code that, when executed in a browser, extracts sensitive payment and authentication data (passwords, credit card numbers, CVC codes) from web forms and sends it to an external attacker-controlled server. Any web application using this compromised version could have exposed user credentials and payment information.
Technical details
The vulnerability is a malicious code injection in the npm package pyramid-proportion version 1.0.5. When the package is imported and executed in a browser environment, injected JavaScript code enumerates HTML form fields for password, CVC, and cardnumber attributes, harvesting sensitive data and exfiltrating it to https://js-metrics.com/minjs.php?pl=. This attack requires no authentication or special preconditions—any web application that included the compromised package version in its dependencies would be vulnerable. The attack vector is network-based through the browser. Users should immediately remove version 1.0.5 and downgrade to version 1.0.4 or remove the package entirely, and audit systems for potential credential compromise.
Affected products
- npm pyramid-proportion 1.0.5
Timeline
- 2020-09-03: disclosed