Malicious Package in bufder-xor
Summary
GHSA-w9q5-mvc6-5cw3: Malicious Package in bufder-xor. Affects bufder-xor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bufder-xor package is an npm package used in JavaScript projects. It provides functionality related to buffer manipulation and XOR operations. The package is vulnerable to a critical security issue that was introduced in version 2.0.2. This version contained malicious code that specifically targeted the Ethereum cryptocurrency. When the package was installed and used in a project, it performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in bufder-xor version 2.0.2 allowed an attacker to compromise Ethereum funds by executing unauthorized transactions. This could lead to financial loss for users who unknowingly installed and used the malicious package. The package exploited the trust placed in it by developers and performed actions that were not intended or authorized. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The bufder-xor package version 2.0.2 contained malicious code that targeted Ethereum funds and performed unauthorized transactions. To mitigate this vulnerability, it is crucial to remove the package from your environment and ensure the integrity of your Ethereum wallets. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for bufder-xor →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
If your project is affected by this vulnerability, you should immediately remove the bufder-xor package from your environment. Additionally, review your Ethereum wallets and transaction history to ensure no unauthorized transactions have occurred.
No, downgrading to a previous version of bufder-xor will not resolve the vulnerability. The malicious code was specifically introduced in version 2.0.2, so any version prior to that should be considered unsafe.
Yes, there are alternative packages available for buffer manipulation and XOR operations in JavaScript. It is recommended to research and choose a package with a good reputation and a history of regular security updates.
To prevent similar vulnerabilities, it is important to regularly update your packages to the latest secure versions. Additionally, consider using a package vulnerability monitoring tool like Vulert, which can alert you in real-time about any open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for bufder-xor.
