Executive brief
jr-sha3 is a JavaScript cryptographic hashing library used in web and Node.js applications. Version 0.8.0 was injected with malicious code that targeted Ethereum cryptocurrency users, stealing private transaction credentials and diverting funds to attacker-controlled wallets without user consent. Affected developers must immediately remove the package and audit their systems for compromised Ethereum funds.
Technical details
The vulnerability is a supply-chain attack (CWE-506: Embedded Malicious Code) in which version 0.8.0 of the jr-sha3 npm package was compromised with backdoor code. The malicious payload executes at runtime within any application that imports the library, intercepts Ethereum transactions or wallet operations, and redirects funds to attacker-controlled addresses. No authentication or special privileges are required; any application using the affected version is vulnerable simply by importing the library. The attack is network-accessible and requires no user interaction beyond normal use of an application that depends on jr-sha3. Developers must update or remove the package entirely and verify integrity of all dependent applications.
Affected products
- npm jr-sha3 0.8.0
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory: GitHub security team reviewed and confirmed malicious code