Executive brief
js-shc3 is a JavaScript library available on npm. Version 0.8.0 contained intentionally malicious code designed to steal Ethereum cryptocurrency by performing unauthorized transactions from users' wallets. Organizations using this package risked direct financial loss and compromise of cryptocurrency holdings.
Technical details
The vulnerability is a malicious code injection (CWE-506) in the js-shc3 npm package, specifically version 0.8.0. The malicious payload was embedded directly in the package and automatically executed when the library was imported, intercepting Ethereum wallet functionality to redirect cryptocurrency transfers to attacker-controlled addresses. The attack requires no special preconditions beyond installing and using the affected package version. An attacker achieves direct theft of cryptocurrency assets. The recommended mitigation is immediate removal of the package from all environments and manual verification of wallet activity for any unauthorized transactions.
Affected products
- npm js-shc3 0.8.0
Timeline
- 2020-09-03: disclosed