Executive brief
The simple-alipay package version 1.0.1 was found to contain malicious code designed to steal sensitive financial information. When used in a web browser, the library automatically scans for credit card numbers, security codes, and passwords entered into forms and sends them to an external server controlled by attackers. This poses a severe risk of data theft and financial fraud for any application using this specific version.
Technical details
Version 1.0.1 of the simple-alipay npm package contains a malicious payload that targets client-side web forms. When executed in a browser environment, the code enumerates input fields such as 'password', 'cvc', and 'cardnumber'. The extracted values are then exfiltrated via an HTTP request to a third-party domain (js-metrics.com). This is a supply chain attack where the malicious code is embedded directly into the library's distribution. Users are advised to downgrade to version 1.0.0 or audit their environments for the presence of the compromised version.
Affected products
- simple-alipay simple-alipay 1.0.1
Timeline
- 2020-09-01: disclosed: Advisory published on GitHub/OSV