Executive brief
buffer-xop is a JavaScript library published on npm. Version 2.0.2 contained malicious code designed to steal Ethereum cryptocurrency by executing unauthorized transactions from users' wallets. Organizations using this package may have had funds transferred without authorization.
Technical details
This is a case of intentional malicious code injection (CWE-506) in the npm package buffer-xop version 2.0.2. The malicious payload was embedded in the package itself and executed automatically when the library was imported and used in an application. The attack vector is network-based, as the compromise occurs through the public npm registry. No authentication is required; any developer downloading and using version 2.0.2 was exposed. The payload targeted Ethereum wallets accessible to the compromised process, performing unauthorized cryptocurrency transactions. The fix is to remove the malicious version and update to a safe version or alternative package.
Affected products
- npm buffer-xop 2.0.2
Timeline
- 2020-09-03: disclosed