Executive brief
The buffermxor npm package, a library used in JavaScript applications, contained hidden malicious code in version 2.0.2 that stole Ethereum cryptocurrency from affected users. The code silently performed unauthorized transactions, transferring funds to wallets controlled by the attacker. Any developer or application using this version should immediately remove it and check whether their Ethereum accounts were compromised.
Technical details
This is a supply-chain attack involving malicious code (CWE-506) injected into a published npm package. Version 2.0.2 of buffermxor contained code that targeted Ethereum cryptocurrency by initiating unauthorized transactions to attacker-controlled wallets. The attack vector is network-based via package installation; no authentication or user interaction is required beyond installing the malicious package. Any application that imported and executed this package version would automatically execute the malicious code. There is no patch for the malicious version; users must remove it entirely and switch to a clean alternative or earlier unaffected versions.
Affected products
- npm buffermxor 2.0.2
Timeline
- 2020-09-03: disclosed: Advisory published on GitHub Security Advisory database
- 2020-08-31: other: GitHub security review confirmed malicious code