Executive brief
buffmr-xor is an npm package used as a utility library. Version 2.0.2 contained malicious code designed to steal Ethereum cryptocurrency by performing unauthorized transactions to attacker-controlled wallets, potentially exposing users' digital assets and funds to theft.
Technical details
This is a supply-chain attack involving intentional malicious code injection (CWE-506: Embedded Malicious Code). Version 2.0.2 of the buffmr-xor npm package was seeded with cryptocurrency-stealing logic that would automatically initiate unauthorized Ethereum transactions. The attack requires only that an application install and execute the affected version, with no special preconditions or user interaction needed. Any developer or application that installed this version from npm could have their Ethereum wallets compromised. Remediation requires immediate removal of the package and verification that no unauthorized transactions occurred.
Affected products
- npm buffmr-xor 2.0.2
Timeline
- 2020-09-03: disclosed
- other: Malicious version 2.0.2 was published and available for installation via npm