Executive brief
The buffer-yor npm package version 2.0.2 contained malicious code designed to steal Ethereum cryptocurrency by performing unauthorized transactions to attacker-controlled wallets. Users who installed this version may have had funds diverted without their knowledge or consent. The malicious package should be immediately removed from all environments and any affected Ethereum accounts should be audited for unauthorized activity.
Technical details
This vulnerability is a supply chain attack involving malicious code injection (CWE-506) in an npm package. Version 2.0.2 of buffer-yor contained code that intercepted and redirected Ethereum cryptocurrency transactions, sending funds to wallets controlled by the attacker instead of the intended recipient. The attack vector is installation and execution of the compromised package—any environment where this version was installed and executed would be affected. No authentication bypass or network vulnerability is required; the malicious code runs with the privileges of the application using the package. The fix is to remove the package and verify no unauthorized transactions occurred.
Affected products
- npm buffer-yor 2.0.2
Timeline
- 2020-09-03: disclosed