Executive brief
Version 0.9.2 of slush-fullstack-framework, a Node.js scaffolding package, contained malicious code that steals payment card information and related sensitive data from web forms. When applications built with this package run in a browser, the injected code searches for password, credit card number, and CVC fields on web pages and exfiltrates the values to a remote server. Any users of version 0.9.2 should immediately remove the package and assess whether customer payment data may have been compromised.
Technical details
The malicious code was intentionally introduced into slush-fullstack-framework version 0.9.2 and executes client-side in the browser. Upon execution, the malware scans web forms for HTML input fields with names containing "password", "cvc", and "cardnumber", extracts their values, and sends them to a remote exfiltration endpoint at https://js-metrics.com/minjs.php. This attack vector exploits developers who rely on the package for scaffolding applications; any web application generated from or bundled with this package version would contain the malicious code. No user interaction is required beyond loading the web page containing the infected code. Mitigation requires removing version 0.9.2 from all environments and downgrading to version 0.9.1 or earlier.
Affected products
- npm slush-fullstack-framework 0.9.2
Timeline
- 2020-09-03: disclosed