Executive brief
jsmsha3 is a JavaScript cryptographic library package published to npm. Version 0.8.0 contained malicious code that hijacked Ethereum cryptocurrency transactions, silently redirecting funds to attacker-controlled wallets without user knowledge or consent. Any application using this version could unknowingly authorize unauthorized cryptocurrency transfers.
Technical details
This is a supply-chain attack via malicious code injection (CWE-506) in an npm package. The malicious payload in version 0.8.0 specifically targets Ethereum wallet interactions and intercepts transaction calls to redirect cryptocurrency to attacker-controlled addresses. The attack requires no authentication or special privileges—any JavaScript application importing and using jsmsha3 0.8.0 would execute the malicious code in the user's environment (browser or Node.js runtime). The vulnerability affects all versions from 0.0.0 through at least 0.8.0, with the confirmed malicious version being 0.8.0. Remediation requires immediate removal of the package and verification that no unauthorized Ethereum transactions occurred.
Affected products
- jsmsha3 project jsmsha3 0.8.0
Timeline
- 2020-09-03: disclosed