Executive brief
The js-shas JavaScript library, commonly used for cryptographic operations, contained malicious code in version 0.8.0 that hijacked Ethereum cryptocurrency transactions. When integrated into applications, the compromised package would silently redirect funds to attacker-controlled wallets, resulting in direct financial theft from users and organizations.
Technical details
Version 0.8.0 of the npm package js-shas contained intentionally injected malicious code (CWE-506: embedded malicious code). The payload targeted Ethereum blockchain operations and modified transaction behavior to redirect cryptocurrency transfers to attacker-controlled addresses. The attack vector is network-based through the npm package registry; any developer or application installing or updating to version 0.8.0 would automatically execute the malicious code at runtime. No special privileges, authentication, or user interaction are required—the malicious payload activates upon package installation and code execution. An attacker could steal all cryptocurrency available to Ethereum wallets managed by the compromised application or its users. The fix is to immediately remove version 0.8.0 from affected environments and downgrade or update to a clean version.
Affected products
- npm js-shas 0.8.0
Timeline
- 2020-09-03: disclosed: GHSA-5wq6-v5cw-jvfr published