Executive brief
buffer-xob is a JavaScript library distributed via npm. Version 2.0.2 contained intentionally malicious code designed to steal Ethereum cryptocurrency by performing unauthorized transactions to attacker-controlled wallets. Any application using this compromised version could have cryptocurrency funds stolen without the user's knowledge or consent.
Technical details
This vulnerability is a malicious package injection (CWE-506: Embedded Malicious Code). Version 2.0.2 of buffer-xob was published with intentional malicious payload targeting the Ethereum blockchain. The attack requires no authentication or special preconditions—any developer who installed this version and used the package in an application that has access to Ethereum wallets or transaction signing capabilities would be at risk. The malware silently performed unauthorized cryptocurrency transfers to wallets controlled by the attacker. Remediation requires immediately removing the package and conducting a security audit of all systems that may have been affected.
Affected products
- npm buffer-xob 2.0.2
Timeline
- 2020-09-03: disclosed