Malicious Package in buffe2-xor
Summary
GHSA-3f97-rj68-2pjf: Malicious Package in buffe2-xor. Affects buffe2-xor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
buffe2-xor is an npm package that is used for [provide brief description of the package functionality]. It is commonly used in [mention the industries or projects where this package is commonly used]. The package is vulnerable to a critical security issue that allows an attacker to perform unauthorized transactions targeting the Ethereum cryptocurrency.
Vulnerability Detail
The vulnerability (GHSA-3f97-rj68-2pjf) was identified in version 2.0.2 of buffe2-xor. This version contained malicious code that specifically targeted Ethereum cryptocurrency transactions. When the package is installed and executed, it performs transactions to wallets that are not controlled by the user. This can lead to financial loss and compromise of Ethereum funds. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. The vulnerability is classified under CWE-506.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. The best course of action is to remove the package and follow the recommended steps for fixing the vulnerability.
Conclusion
The buffe2-xor package contains a critical vulnerability (GHSA-3f97-rj68-2pjf) that allows unauthorized transactions targeting the Ethereum cryptocurrency. It is crucial to remove the package and take necessary steps to ensure the integrity of Ethereum funds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buffe2-xor →
FAQ
buffe2-xor is an npm package used for [provide brief description of the package functionality]. It is commonly used in [mention the industries or projects where this package is commonly used].
The vulnerability allows an attacker to perform unauthorized transactions targeting the Ethereum cryptocurrency. This can lead to financial loss and compromise of Ethereum funds.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to remove the buffe2-xor package from your environment and ensure no Ethereum funds have been compromised. Review your transaction history and verify the integrity of your wallets.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffe2-xor.
