Executive brief
The npm package buffeb-xor version 2.0.2 contained malicious code designed to steal Ethereum cryptocurrency. When installed and used, the compromised package automatically performed unauthorized blockchain transactions, redirecting funds to wallets controlled by the attacker rather than the legitimate application owner. Organizations using this package should immediately remove it and audit their cryptocurrency holdings for unauthorized transfers.
Technical details
The buffeb-xor npm package (versions up to 2.0.2) was compromised with intentional malicious code (CWE-506: Embedded Malicious Code). The vulnerability exploits the trust model of open source package distribution; when developers installed this package as a dependency, the malicious code executed automatically during runtime. The attack targeted Ethereum blockchain transactions by hijacking or redirecting fund transfers to attacker-controlled wallets. Since this is a direct code injection attack with no authentication bypass or special preconditions required, any application using the affected version would be compromised upon installation and execution. The fix is immediate removal of the package; users should audit blockchain transactions and wallet activity for unauthorized activity during the exposure period.
Affected products
- npm buffeb-xor 2.0.2
Timeline
- 2020-09-03: disclosed: Vulnerability published to GitHub Advisory Database
- 2020-08-31: other: GitHub security team review completed