Executive brief
Version 0.0.7 of the react-server-native npm package contained malicious code that harvests sensitive payment card information (credit card numbers, CVV codes, and passwords) from web forms and transmits it to a remote server. Organizations using this package version risk exposure of customer payment data and credentials, with potential regulatory and reputational consequences.
Technical details
A supply-chain attack in react-server-native v0.0.7 injected client-side JavaScript that automatically scrapes password, CVC, and card number fields from HTML forms and exfiltrates the data to https://js-metrics.com/minjs.php?pl=. The malicious code executes in the browser context with access to form data, requiring no special privileges or user interaction beyond loading an affected application. The vulnerability affects any application bundling or importing this specific version. Mitigation requires upgrading or downgrading to a different version and auditing systems to determine whether sensitive data was compromised during the exposure period.
Affected products
- npm react-server-native 0.0.7
Timeline
- 2020-09-01: disclosed