Executive brief
bufber-xor is a JavaScript utility library distributed via npm. Version 2.0.2 of the package contained malicious code that silently stole Ethereum cryptocurrency by performing unauthorized transactions from affected users' wallets. This poses a direct financial risk to any user or service using the affected version.
Technical details
This vulnerability is classified as malicious code (CWE-506) intentionally injected into the npm package bufber-xor. The malware was present in version 2.0.2 and targeted Ethereum wallets by executing unauthorized cryptocurrency transactions. The attack vector is network-based—any system installing the compromised package version would execute the malicious code upon import or installation. No authentication or user interaction is required; the payload runs automatically as part of the package initialization. The impact is direct financial theft of Ethereum funds. Mitigation requires immediate removal of the affected package version from all environments.
Affected products
- npm bufber-xor 2.0.2
Timeline
- 2020-09-03: disclosed