Executive brief
jc-sha3 is a JavaScript cryptographic library distributed via npm. Version 0.8.0 contained malicious code that intercepted and redirected Ethereum cryptocurrency transactions to attacker-controlled wallets, potentially causing direct financial loss to users. This represents a supply-chain attack where a compromised package steals funds from anyone using the affected version.
Technical details
The vulnerability is a malicious code injection (CWE-506) embedded in version 0.8.0 of the jc-sha3 npm package. The malicious payload targeted Ethereum cryptocurrency transactions, hijacking them to divert funds to wallets controlled by the attacker. The attack was introduced at the package level with no authentication or user interaction required—any application importing the compromised version would execute the malicious code with the privileges of the running process. This is a supply-chain attack requiring immediate removal of the package and verification that no funds were compromised.
Affected products
- npm jc-sha3 0.8.0
Timeline
- 2020-09-03: disclosed