Executive brief
js-sha7 is a JavaScript library for cryptographic hashing. Version 0.8.0 was published with intentionally malicious code that stole Ethereum cryptocurrency by initiating unauthorized transactions to attacker-controlled wallets. Any application using this specific version could have had user funds compromised.
Technical details
This is a supply-chain attack involving malicious code injection into an npm package. Version 0.8.0 of js-sha7 contained code that targeted Ethereum users, performing unauthorized cryptocurrency transactions. The attack vector is network-based via package dependency installation; any developer or application that installed the affected version would execute the malicious payload. The vulnerability class is CWE-506 (embedded malicious code). No patch for the malicious version exists; the recommendation is to immediately remove the package and verify no funds were compromised.
Affected products
- js-sha7 js-sha7 0.8.0
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory