Executive brief
beffer-xor is a JavaScript library available on npm. Version 2.0.2 contained embedded malicious code that automatically stole Ethereum cryptocurrency by performing unauthorized transactions to attacker-controlled wallets. Any application using this library version would have unknowingly exposed all Ethereum funds accessible to that application.
Technical details
This is a supply chain attack (CWE-506: Embedded Malicious Code) where malicious code was injected directly into the library itself. The attack vector is package installation—any developer who installed beffer-xor version 2.0.2 via npm would have executed the malicious payload without authentication or user interaction required. The malicious code specifically targeted Ethereum wallets and performed unauthorized cryptocurrency transactions to attacker-controlled addresses. The vulnerability requires no preconditions beyond installing and importing the affected package version.
Affected products
- npm beffer-xor 2.0.2
Timeline
- 2020-09-03: disclosed