Executive brief
Version 2.0.2 of the buffer-xmr npm package contained malicious code designed to steal Ethereum cryptocurrency. When installed, the package would automatically execute unauthorized transactions, sending funds to attacker-controlled wallets. Organizations using this package are at risk of direct financial loss and should immediately remove it and audit any compromised Ethereum accounts.
Technical details
This is a supply chain attack (CWE-506: Embedded Malicious Code) in which a legitimate-appearing npm package was compromised to include malicious payload. Version 2.0.2 of buffer-xmr was published with embedded code that targets Ethereum wallets and performs unauthorized cryptocurrency transfers to attacker-controlled addresses. The attack vector is network-based via the public npm registry; any developer or automation system installing or updating the package would execute the malicious code in their environment. No user interaction or authentication bypass is required—merely installing the affected version triggers the payload. The impact is direct financial loss through unauthorized Ethereum transactions. Remediation requires removing the package from all environments, clearing caches, and auditing Ethereum accounts for unauthorized activity.
Affected products
- npm buffer-xmr 2.0.2
Timeline
- 2020-09-03: disclosed