Malicious Package in bubfer-xor
Summary
GHSA-vm67-mh96-95mq: Malicious Package in bubfer-xor. Affects bubfer-xor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bubfer-xor package is an npm package that is used in various projects. It provides functionality related to XOR operations. XOR (exclusive OR) is a logical operation that returns true if one and only one of the operands is true. The package is vulnerable to a malicious code injection in version 2.0.2.
Vulnerability Detail
Version 2.0.2 of the bubfer-xor package contained malicious code that specifically targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user. The vulnerability poses a critical risk as it can result in the compromise of Ethereum funds. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The bubfer-xor package version 2.0.2 contains malicious code that targets the Ethereum cryptocurrency. This vulnerability poses a critical risk and can result in the compromise of Ethereum funds. It is recommended to remove the package from your environment and ensure no funds were compromised. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for bubfer-xor →
FAQ
The bubfer-xor package is an npm package that provides functionality related to XOR operations.
The malicious code in version 2.0.2 targets the Ethereum cryptocurrency and performs unauthorized transactions to wallets not controlled by the user. This can result in the compromise of Ethereum funds.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to remove the bubfer-xor package from your environment. Additionally, ensure that no Ethereum funds were compromised.
For more information about this vulnerability, you can visit the GitHub advisory database at the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for bubfer-xor.
