Executive brief
The js-3ha3 npm package version 0.8.0 contained deliberately injected malicious code designed to steal cryptocurrency from users. When the package was installed and executed, it performed unauthorized Ethereum transactions, draining funds from affected users' wallets. This is a supply chain attack that compromised the integrity of a publicly available software library.
Technical details
This vulnerability is classified as malicious code (CWE-506) injected into version 0.8.0 of the js-3ha3 npm package. The attack vector is network-based and requires no authentication or user interaction beyond standard package installation and execution. The malicious payload specifically targeted Ethereum cryptocurrency holdings, executing unauthorized transactions to wallets controlled by the attacker. The attack is straightforward—any developer or application that installed and ran this specific package version would have their cryptocurrency compromised. The fix is to remove the package from all environments and verify no Ethereum funds were stolen.
Affected products
- npm js-3ha3 0.8.0
Timeline
- 2020-09-03: disclosed: Vulnerability published to GitHub Advisory Database
- 2020-08-31: other: GitHub security team reviewed and confirmed malicious package