Executive brief
uploader-plugin is an npm package used in web applications. Version 1.0.2 contained malicious code that harvested sensitive form data—including passwords, credit card numbers, and CVV codes—from users' browsers and transmitted it to a remote attacker-controlled server. Organizations using this package risked exposing customer financial and authentication credentials.
Technical details
Version 1.0.2 of uploader-plugin contained injected malicious JavaScript code that executes in the browser context. The malware enumerates HTML form fields matching patterns for password, credit card number, and CVC/CVV data, then exfiltrates the collected values via HTTP POST to https://js-metrics.com/minjs.php?pl=. No authentication or special privileges are required—the attack triggers automatically when the package is loaded and the user interacts with affected forms. The attack vector is network-based, affecting any application that included the malicious package version. Unaffected versions include 1.0.1 and earlier; users should remove version 1.0.2 entirely and audit logs for potential data compromise.
Affected products
- npm uploader-plugin 1.0.2
Timeline
- 2020-09-03: disclosed