Executive brief
The buffar-xor npm package contained intentionally malicious code designed to steal cryptocurrency from Ethereum wallets. Version 2.0.2 performed unauthorized transactions, sending funds to wallets not controlled by the user. Any developer who installed this version should immediately remove it and verify their Ethereum holdings were not compromised.
Technical details
This is a supply-chain attack via a malicious package published to npm. The vulnerability class is intentional malware injection (CWE-506). Version 2.0.2 of buffar-xor contained code that targeted Ethereum cryptocurrency, performing unauthorized wallet transactions to attacker-controlled addresses. The attack vector is local/installation-based: any developer or CI/CD system that fetched and executed this package version would run the malicious code with the privileges of the npm install process. No authentication or network preconditions apply; exploitation occurs automatically upon package installation. An attacker gains the ability to exfiltrate cryptocurrency from any Ethereum wallets accessible to the compromised environment. The package has been removed from npm.
Affected products
- npm buffar-xor 2.0.2
Timeline
- 2020-09-03: disclosed: Malicious package disclosed via GitHub advisory GHSA-f64g-whxf-w8f2