Executive brief
buffer-hor is a JavaScript library used in npm projects. Version 2.0.2 was compromised and contained malicious code that silently executed unauthorized cryptocurrency transactions, stealing Ethereum funds from affected users. Organizations using this package need to immediately remove it and verify their cryptocurrency wallets for unauthorized activity.
Technical details
The npm package buffer-hor version 2.0.2 contained embedded malicious code (CWE-506: intentionally malicious code) injected into the library. The attack exploited the trust in open-source supply chains; developers unknowingly installed the compromised version via npm, and the malicious code executed without user interaction or authentication when the library was imported and used in applications. The malicious payload performed unauthorized blockchain transactions, stealing Ethereum cryptocurrency from users' wallets. No patch is available—remediation requires complete removal of the package and validation of affected cryptocurrency wallets.
Affected products
- npm buffer-hor 2.0.2
Timeline
- 2020-09-03: disclosed: Malicious package identified and published to OSV/GitHub Advisory Database
- 2020-08-31: other: GitHub security team reviewed and confirmed maliciousness