Executive brief
The ns-sha3 npm package version 0.8.0 was compromised and contained malicious code designed to steal Ethereum cryptocurrency. When installed, the malicious code performed unauthorized cryptocurrency transactions from affected users' wallets to attacker-controlled addresses, resulting in direct financial loss.
Technical details
The vulnerability is a supply-chain attack vector (CWE-506: Embedded Malicious Code) in which an npm package was modified to include malicious code targeting Ethereum users. The attack affects version 0.8.0 of ns-sha3, a JavaScript library for SHA3 cryptographic hashing. The malicious payload executes during package installation or runtime with no authentication or special user interaction required, operating at the network layer without local access controls. Attackers achieved arbitrary code execution on affected systems to drain cryptocurrency funds. The fix requires immediate removal of affected package versions and verification that no unauthorized transactions occurred on linked Ethereum accounts.
Affected products
- npm ns-sha3 0.8.0
Timeline
- 2020-09-03: disclosed