Executive brief
jq-sha3 is a popular Node.js cryptographic library package. Version 0.8.0 contained malicious code that silently stole cryptocurrency (Ethereum) from users by sending their funds to attacker-controlled wallets without authorization. Users who installed this version could lose cryptocurrency funds stored on systems where the package was deployed.
Technical details
This is a supply-chain attack delivered via a malicious npm package (CWE-506: embedded malicious code). Version 0.8.0 of jq-sha3 contained obfuscated code designed to interact with Ethereum wallets and initiate unauthorized cryptocurrency transfers. The attack is trivial to trigger—any installation or use of the affected package version would execute the malicious payload. No authentication, network preconditions, or user interaction beyond installing the package was required. Affected users should immediately remove the package and verify that no Ethereum funds were transferred from their systems.
Affected products
- jq-sha3 jq-sha3 0.8.0
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory