Malicious Package in bs-sha3
Summary
GHSA-88xx-23mf-rcj2: Malicious Package in bs-sha3. Affects bs-sha3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bs-sha3 package is an npm package that provides a SHA-3 implementation for BuckleScript, a JavaScript backend for the OCaml compiler. It is commonly used in projects that require cryptographic hashing functionality. However, version 0.8.0 of the package contained malicious code that specifically targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user, potentially resulting in the loss of Ethereum funds.
Vulnerability Detail
The vulnerability in bs-sha3 version 0.8.0 allowed an attacker to compromise the Ethereum funds of users who installed the package. By injecting malicious code, the attacker was able to perform unauthorized transactions to external wallets. This could lead to financial losses for affected users. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The bs-sha3 package version 0.8.0 contained malicious code that targeted Ethereum funds and performed unauthorized transactions. To mitigate this vulnerability, it is crucial to remove the package from the environment, verify the integrity of Ethereum funds, and monitor wallets for any suspicious activity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bs-sha3 →
FAQ
bs-sha3 is an npm package that provides a SHA-3 implementation for BuckleScript, a JavaScript backend for the OCaml compiler. It is commonly used for cryptographic hashing in projects.
Version 0.8.0 of bs-sha3 is the specific version that contained the malicious code.
The malicious code targeted the Ethereum cryptocurrency and performed unauthorized transactions to external wallets, potentially resulting in the loss of Ethereum funds.
To protect your Ethereum funds, it is recommended to remove the bs-sha3 package from your environment, verify that no unauthorized transactions have occurred, and regularly monitor your Ethereum wallets for any suspicious activity.
Yes, the fix for this vulnerability is to remove the bs-sha3 package from your environment and ensure that you are using a secure version of the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for bs-sha3.
