Executive brief
j3-sha3 is a JavaScript library for cryptographic hashing. Version 0.8.0 contained intentionally malicious code that stole cryptocurrency from users by redirecting Ethereum transactions to attacker-controlled wallets. Users who installed this compromised version are at risk of direct financial loss.
Technical details
This is a supply-chain attack (CWE-506: Embedded Malicious Code) in which version 0.8.0 of the j3-sha3 npm package contained intentionally injected malicious payload. The attack vector is installation—any user or automated system that installed or updated to version 0.8.0 would execute the hostile code. The malicious code monitored and intercepted Ethereum cryptocurrency transactions, redirecting funds to wallets controlled by the attacker instead of the legitimate recipient. No authentication or special privileges were required; exploitation occurred automatically upon installation. The package has been removed from npm and users must uninstall the affected version immediately and verify their Ethereum wallets for unauthorized activity.
Affected products
- npm j3-sha3 0.8.0
Timeline
- 2020-09-03: disclosed