Executive brief
The buffer-xnr npm package, used by developers as a utility library, contained hidden malicious code in version 2.0.2 designed to steal Ethereum cryptocurrency. When installed, the package would automatically execute unauthorized transactions from affected users' Ethereum wallets to attacker-controlled addresses, resulting in direct financial loss.
Technical details
This vulnerability is classified as malicious code injection (CWE-506). Version 2.0.2 of the buffer-xnr npm package contained embedded malicious logic targeting Ethereum wallet interactions. The attack requires no authentication or user interaction beyond installing the compromised version—the malicious code executes automatically at runtime. An attacker who compromised or created this package could harvest private keys or intercept transaction signings to redirect Ethereum funds to attacker-controlled wallets. No patch for the malicious version exists; the only mitigation is to remove the package entirely and audit any systems that installed version 2.0.2.
Affected products
- npm buffer-xnr 2.0.2
Timeline
- 2020-09-03: disclosed