Executive brief
bufder-xor is a JavaScript library used in web and Node.js applications. Version 2.0.2 contained hidden malicious code that stole Ethereum cryptocurrency by performing unauthorized transactions from user wallets. Any application that installed this specific version could have had wallet funds directly compromised without the application owner's knowledge.
Technical details
This is a supply-chain attack via a malicious package published to the npm registry (CWE-506: embedded malicious code). Version 2.0.2 of bufder-xor contained obfuscated malicious JavaScript code that targeted Ethereum wallets and initiated unauthorized cryptocurrency transactions to attacker-controlled addresses. The attack required only that an application install and load the malicious package version—no authentication, user interaction, or specialized network conditions were necessary. The vulnerability was detected and the package was yanked from npm; affected users must remove the package and verify no funds were stolen.
Affected products
- npm bufder-xor 2.0.2
Timeline
- 2020-09-03: disclosed: Malicious package published to npm registry