Executive brief
The js-sja3 npm package version 0.8.0 contained hidden malicious code designed to steal cryptocurrency from users. The injected code performed unauthorized Ethereum transactions, redirecting funds to attacker-controlled wallets without user knowledge or consent. Organizations using this package need to remove it immediately and verify that no cryptocurrency funds have been compromised.
Technical details
This is a supply-chain attack via package poisoning (CWE-506: Embedded Malicious Code). Version 0.8.0 of the js-sja3 npm package contained injected malicious code targeting Ethereum cryptocurrency wallets. The attack is network-accessible (no authentication required) and executes automatically when the package is imported or used, allowing an attacker to exfiltrate private keys and perform unauthorized cryptocurrency transactions. Affected users must immediately remove the package, audit their dependencies, and verify Ethereum account activity. The affected version is no longer available from npm, but users who installed 0.8.0 remain at risk.
Affected products
- npm js-sja3 0.8.0
Timeline
- 2020-09-03: disclosed: GHSA-6343-m2qr-66gf published