Executive brief
The bs-sha3 npm package version 0.8.0 contained malicious code designed to steal cryptocurrency from Ethereum users. When installed, the compromised version performed unauthorized transactions to attacker-controlled wallets, directly draining funds from affected users' accounts. Organizations must immediately remove this package and audit for any unauthorized Ethereum transactions.
Technical details
The vulnerability is a malicious code injection (CWE-506) in the bs-sha3 npm library version 0.8.0. The malicious payload specifically targeted Ethereum cryptocurrency functionality, intercepting legitimate transactions and redirecting funds to attacker-controlled wallets. Attack vector is network-based; any developer or application that installed or updated to version 0.8.0 would have unknowingly executed the malicious code. There is no patch for this supply chain attack—the affected version must be completely removed and replaced with a clean version prior to 0.8.0 or after the issue was remediated.
Affected products
- npm bs-sha3 0.8.0
Timeline
- 2020-09-03: disclosed