Executive brief
js-sla3 is a JavaScript library distributed via npm. Version 0.8.0 contained embedded malicious code designed to steal Ethereum cryptocurrency by initiating unauthorized transactions to attacker-controlled wallets. Any application using this compromised version could result in immediate financial loss of cryptocurrency holdings.
Technical details
This vulnerability is a supply-chain attack (CWE-506: Embedded Malicious Code) where malicious code was injected into the npm package js-sla3 at version 0.8.0. The malicious payload targets Ethereum wallets and executes unauthorized cryptocurrency transactions to attacker-controlled addresses. The attack requires no authentication or user interaction—simply installing and running the affected version triggers the malicious behavior. Developers who installed this package version may have suffered direct financial loss. Remediation requires immediate removal of the package and verification that no Ethereum transactions occurred from affected systems.
Affected products
- npm js-sla3 0.8.0
Timeline
- 2020-09-03: disclosed