Executive brief
Version 1.0.2 of the radic-util JavaScript library contained malicious code that would steal sensitive form data (passwords, card numbers, and CVCs) from web applications and exfiltrate it to an external server. This affects any web application that included this compromised package version in their dependencies.
Technical details
radic-util version 1.0.2 contained injected malicious code that executes in the browser context. The code searches for HTML form fields with names matching "password", "cvc", and "cardnumber", extracts their values, and sends them to an attacker-controlled server at https://js-metrics.com/minjs.php. This is a supply-chain attack via a compromised npm package. The attack requires only that an affected version be installed and used in a web application; no authentication or unusual user interaction is required.
Affected products
- radic-util 1.0.2
Timeline
- 2020-09-11: disclosed: Vulnerability disclosed and published to OSV