Executive brief
bufver-xor is a Node.js library published on npm. Version 2.0.2 contained injected malicious code designed to steal Ethereum cryptocurrency by initiating unauthorized transactions from users' wallets. This represents a supply-chain attack where a compromised dependency can directly compromise financial assets of any application using the affected version.
Technical details
This is a malicious code injection vulnerability (CWE-506) affecting the bufver-xor npm package version 2.0.2. The vulnerability was introduced through a compromised or intentionally malicious package release on the npm registry. The malicious code executes at runtime when the package is loaded, allowing it to detect and interact with Ethereum wallets in the execution environment, initiating transactions without authorization. No patches are applicable; the only remediation is removal of the affected version. This attack vector is network-based in the sense that dependency resolution occurs during package installation, and the malicious code runs with the privileges of the application using it.
Affected products
- npm bufver-xor 2.0.2
Timeline
- 2020-09-03: disclosed: Vulnerability published on GitHub Advisory Database and npm security advisories
- 2020-08-31: other: GitHub reviewed the advisory