Executive brief
Version 0.3.0 of the npm package react-dates-sc, a date picker library for React applications, contained deliberately injected malicious code. When executed in a user's browser, the malicious code would steal sensitive form data including passwords, credit card numbers, and verification codes, sending them to an external attacker-controlled server. Any application that installed this specific version could have exposed customer payment and authentication credentials.
Technical details
This is a supply-chain attack involving a malicious code injection into a JavaScript npm package. Version 0.3.0 of react-dates-sc contained code that would execute in the browser context and scan form elements for fields with names/IDs matching common password, credit card, and CVC patterns, extracting their values and sending them via HTTP GET requests to https://js-metrics.com/minjs.php?pl=. The attack vector is network-based and automatic upon page load—no user interaction or special privileges are required. Any browser user accessing a web application that included the compromised version would be affected. Remediation involves upgrading to an unaffected version (any version other than 0.3.0) and conducting a security audit to determine if sensitive data was exfiltrated during the period the malicious package was installed.
Affected products
- npm react-dates-sc 0.3.0
Timeline
- 2020-09-01: disclosed: Advisory published
- 2020-08-31: other: GitHub reviewed