Executive brief
buffer-xoz is a JavaScript library used in Node.js applications, version 2.0.2 of which contained malicious code that intercepted Ethereum cryptocurrency transactions. An attacker who deployed this compromised version could steal funds by redirecting transactions to attacker-controlled wallets, resulting in direct financial loss to any user running the infected package.
Technical details
This is a supply-chain attack (CWE-506: Embedded Malicious Code) in which a legitimate npm package was compromised to include malicious payload. Version 2.0.2 of buffer-xoz was backdoored with code that detected Ethereum transactions and modified recipient wallet addresses to redirect funds to attacker-controlled accounts. The attack required no authentication or user interaction—any application installing the malicious version would automatically execute the payload. The vulnerability affects the runtime behavior of applications that depend on the package. Removal of the package and verification of blockchain transaction history are the recommended remediation steps.
Affected products
- npm buffer-xoz 2.0.2
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory: GitHub security advisory review completed