Executive brief
Versions 2.4.2 and 2.4.3 of the react-datepicker-plus npm package contained malicious code that steals sensitive form data from end users. When the affected package is executed in a browser, it harvests passwords, credit card numbers, and CVV codes from web forms and sends them to an attacker-controlled server, putting customer financial and personal data at immediate risk.
Technical details
The react-datepicker-plus package versions 2.4.2 and 2.4.3 contained intentionally injected malicious code (CWE-506: Embedded Malicious Code) that executes in the browser context. The code enumerates HTML form fields matching patterns for passwords, CVV (card verification codes), and card numbers, extracts their values, and exfiltrates them to https://js-metrics.com/minjs.php?pl=. The attack vector is network-based and requires no user authentication or special interaction beyond visiting a website that includes the affected package. Any web application using the compromised versions would expose user credentials and payment card data to the attacker. The vulnerability was fixed in version 2.4.6 and later.
Affected products
- npm react-datepicker-plus 2.4.2 to 2.4.3
Timeline
- 2020-09-11: disclosed