Executive brief
fuffer-xor is a JavaScript library published on npm. Version 2.0.2 contained malicious code that automatically initiated unauthorized cryptocurrency transactions, sending Ethereum funds to attacker-controlled wallets. Any organization or individual using this compromised version could suffer direct financial loss without authorization or knowledge.
Technical details
This package contains intentional malicious code (CWE-506: Embedded Malicious Code) injected into version 2.0.2. The malware targets Ethereum cryptocurrency by performing unauthorized blockchain transactions to wallets outside the user's control. The vulnerability affects any application that imports and executes the compromised package; no special privileges, authentication, or user interaction are required—the malicious behavior runs automatically as part of the library's normal operation. Attackers achieve direct financial loss by diverting cryptocurrency funds. Remediation requires immediately removing the package and auditing for unauthorized transactions on associated Ethereum accounts.
Affected products
- npm fuffer-xor 2.0.2
Timeline
- 2020-09-03: disclosed