Executive brief
jw-sha3 is a JavaScript library used for cryptographic hashing. Version 0.8.0 of this library contained malicious code designed to steal Ethereum cryptocurrency by performing unauthorized transactions from users' wallets. Developers and applications using this specific version were at risk of financial loss and account compromise.
Technical details
The vulnerability is a trojanized library (CWE-506: Embedded Malicious Code). Version 0.8.0 of jw-sha3 contained intentionally injected malicious code that performed unauthorized Ethereum cryptocurrency transfers to attacker-controlled wallets. The attack vector is network-based, requiring only that the compromised package be installed and imported into an application. No authentication, user interaction, or additional preconditions are needed; the malicious payload executes at runtime when the library functions are used. Attackers achieved direct access to Ethereum wallet functionality and blockchain transaction capability. The fix is immediate removal of version 0.8.0 from all environments and replacement with a known-clean version.
Affected products
- npm jw-sha3 0.8.0
Timeline
- 2020-09-03: disclosed
- 2020-08-31: other: Advisory reviewed and confirmed by GitHub security team