Executive brief
radicjs is a JavaScript library distributed via npm. Version 0.2.1 contained malicious code that would steal payment card details, expiration dates, security codes, and passwords from web forms and send them to an attacker-controlled server. Any application using this version could have exposed sensitive user data including full payment card information and login credentials.
Technical details
This is a malicious package vulnerability—a supply-chain attack where the npm package radicjs version 0.2.1 was compromised with malicious JavaScript code. The attack vector is installation of the affected package version; the malicious code executes immediately when the JavaScript library is loaded in a browser context. The injected code uses DOM manipulation to enumerate password, card number, and CVC fields from HTML forms, captures their values when users interact with the forms, and exfiltrates the data via HTTP requests to https://js-metrics.com/minjs.php?pl=. No authentication or special preconditions are required—any user visiting a website using the affected package version is impacted. The attack achieves wholesale credential and payment card theft. Mitigation is to remove version 0.2.1 immediately and downgrade to 0.2.0 or uninstall the package entirely.
Affected products
- npm radicjs 0.2.1
Timeline
- 2020-09-03: disclosed: Vulnerability published on OSV and GitHub advisory database