Executive brief
The zs-sha3 npm package version 0.8.0 contained malicious code injected by an attacker. When installed, the package silently performed unauthorized cryptocurrency transactions, sending Ethereum funds to wallets controlled by the attacker instead of the legitimate user. Organizations using this package may have suffered direct financial loss and should verify whether their Ethereum holdings were compromised.
Technical details
This is a supply-chain attack vulnerability (CWE-506: embedded malicious code) in the npm package zs-sha3. Version 0.8.0 was poisoned with code that targeted Ethereum cryptocurrency users, performing unauthorized wallet transactions without authentication or user interaction. The malicious code executes at runtime during package import or use. As this is a compromised package rather than a software vulnerability, the primary mitigation is to immediately remove the affected version from all environments and verify no cryptocurrency was stolen. No patch exists; users must uninstall and switch to a trusted alternative or earlier uncompromised versions.
Affected products
- npm zs-sha3 0.8.0
Timeline
- 2020-09-03: disclosed