Executive brief
buffur-xor is a JavaScript library used for data manipulation in Node.js applications. Version 2.0.2 contained malicious code that siphoned Ethereum cryptocurrency from users to attacker-controlled wallets, resulting in direct financial loss. Applications using this specific version should be removed immediately and any Ethereum wallets that interacted with affected systems should be audited for unauthorized transactions.
Technical details
This is a supply-chain attack involving intentional malicious code injection (CWE-506: Embedded Malicious Code) into an open-source npm package. The malicious variant (version 2.0.2) hijacked cryptocurrency transactions by intercepting Ethereum operations and redirecting funds to attacker-controlled addresses. The attack requires no user interaction or authentication—any application importing this specific version of buffur-xor will execute the malicious payload at runtime. The remediation is to immediately remove the malicious version and audit affected systems for compromise indicators.
Affected products
- npm buffur-xor 2.0.2
Timeline
- 2020-09-03: disclosed