Executive brief
The xoc npm package, a JavaScript library used in web applications, included malicious code in version 1.0.7 that harvested payment card numbers, CVV codes, and passwords from web forms and sent them to an attacker's server. Any website or application using this poisoned package version would have silently leaked customer financial data without the knowledge of developers or end-users.
Technical details
A malicious actor compromised the xoc npm package and injected form-scraping code into version 1.0.7. When executed in a browser context, the malicious payload enumerates HTML form fields matching password, cvc, and cardnumber patterns, then exfiltrates collected values to https://js-metrics.com/minjs.php?pl= via HTTP requests. No authentication or special user interaction is required—any page loading the compromised package automatically triggers the theft. The attack vector is supply-chain compromise: developers unknowingly depend on the poisoned package version. Remediation requires immediate removal of version 1.0.7 and replacement with 1.0.5 or earlier (or a patched version after 1.0.7 if released), followed by forensic review to determine whether user payment or authentication data was exposed.
Affected products
- npm xoc 1.0.7
Timeline
- 2020-09-01: disclosed: Malicious version 1.0.7 publicly disclosed in GHSA advisory