Executive brief
The npm package js-cha3 contained malicious code that was designed to steal cryptocurrency by directing Ethereum transactions to attacker-controlled wallets. Users who installed version 0.8.0 may have experienced unauthorized fund transfers. The package should be immediately removed from all environments and affected Ethereum wallets should be audited for unauthorized activity.
Technical details
The vulnerability is a trojanized software supply chain attack (CWE-506: Embedded Malicious Code). Version 0.8.0 of the js-cha3 npm package contained intentionally injected malicious code that intercepts or manipulates Ethereum cryptocurrency transactions. The attack vector is network-based; any developer or application that installed or executed this package version was at risk. No authentication or special preconditions were required—simply using the package triggered the malicious behavior. An attacker could redirect Ethereum transactions to wallets under their control, resulting in direct financial theft. The malicious code has been removed in subsequent versions, but all installations of version 0.8.0 should be purged.
Affected products
- npm js-cha3 0.8.0
Timeline
- 2020-09-03: disclosed: Vulnerability disclosed by GitHub Advisory Database
- 2020-08-31: other: GitHub reviewed and confirmed malicious code in version 0.8.0