Executive brief
bugfer-xor is a JavaScript utility library distributed via npm. Version 2.0.2 of this package contained malicious code that intercepted Ethereum cryptocurrency transactions and diverted funds to attacker-controlled wallets, resulting in direct financial loss to affected users.
Technical details
This is a supply-chain attack (CWE-506: Embedded Malicious Code) where a legitimate-appearing package was poisoned with cryptocurrency theft functionality. The malicious version (2.0.2) was published to the npm registry and silently executed code during installation or runtime to steal Ethereum funds by redirecting blockchain transactions to attacker-controlled wallets. No authentication, special privileges, or user interaction beyond installing the package was required for exploitation. The vulnerability affects anyone who installed the compromised version.
Affected products
- npm bugfer-xor 2.0.2
Timeline
- 2020-09-03: disclosed: Vulnerability published in GitHub Advisory Database