Malicious Package in b5ffer-xor: Ethereum Funds Compromised
Summary
GHSA-jvfv-jhw9-jmpp: Malicious Package in b5ffer-xor. Affects b5ffer-xor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
b5ffer-xor is an npm package that is part of the Ethereum cryptocurrency ecosystem. It provides functionality related to Ethereum transactions and wallet management. However, version 2.0.2 of the package contained malicious code that targeted Ethereum funds and performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in b5ffer-xor version 2.0.2 allowed an attacker to compromise Ethereum funds by executing unauthorized transactions. This malicious code was designed to exploit the package's functionality and divert funds to wallets controlled by the attacker. The impact of this vulnerability could result in financial loss for users who had installed and used the affected version of the package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The b5ffer-xor package version 2.0.2 contained malicious code that targeted Ethereum funds and performed unauthorized transactions. To mitigate this vulnerability, it is crucial to remove the affected package, verify Ethereum wallets and transactions, and update to a secure version or consider alternative packages. For further assistance, please contact DevNack.com.
See every vulnerability recorded for b5ffer-xor →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the package-lock.json file without requiring access to the code or installation.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. This indicates a high level of risk and potential impact on affected systems.
If your application is affected, it is recommended to remove the b5ffer-xor package, verify Ethereum wallets and transactions for any unauthorized activity, and update to a secure version of the package or switch to alternative packages.
There is no specific workaround mentioned for this vulnerability. The best course of action is to remove the affected package and take the recommended steps to secure your Ethereum funds.
For further support and information on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for b5ffer-xor.
