Executive brief
bufner-xor is a JavaScript library available on npm. Version 2.0.2 contained malicious code designed to steal Ethereum cryptocurrency by executing unauthorized transactions from users' wallets. Any application or user that installed this version was at risk of financial theft.
Technical details
This is a supply-chain attack involving malicious code injection (CWE-506) into a published npm package. Version 2.0.2 of bufner-xor contained code that targeted Ethereum wallets and initiated unauthorized cryptocurrency transactions to attacker-controlled addresses. The attack required only that a developer or application install the compromised package version; no authentication, network configuration, or additional preconditions were needed. The malicious payload executes at install time or during normal package usage. Users should immediately remove the package and audit any Ethereum accounts that may have been exposed.
Affected products
- npm bufner-xor 2.0.2
Timeline
- 2020-09-03: disclosed: Advisory published