Executive brief
hs-sha3 is a popular JavaScript cryptography library used for SHA3 hashing operations. Version 0.8.0 contained malicious code that targeted Ethereum cryptocurrency holdings, performing unauthorized transactions to attacker-controlled wallets. Users who installed this compromised version face direct financial loss and should immediately audit their systems for unauthorized activity.
Technical details
The vulnerability is a supply-chain compromise (CWE-506: embedded malicious code) in hs-sha3 version 0.8.0 published to npm. The package contained obfuscated malicious code that specifically targeted Ethereum cryptocurrency transactions, hijacking funds by directing them to unauthorized wallets. As this is a compromised npm package, the attack vector is download/installation with no authentication or user interaction required beyond adding the package as a dependency. Any system that installed version 0.8.0 is affected; the malicious payload executes at installation or runtime. Remediation requires removing the affected version immediately and validating that no funds were transferred.
Affected products
- npm hs-sha3 0.8.0
Timeline
- 2020-09-03: disclosed