Malicious Package in buffer-8or
Summary
GHSA-4hm7-73ch-vm59: Malicious Package in buffer-8or. Affects buffer-8or versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The buffer-8or package is an npm package used in JavaScript applications. It provides functionality related to buffers, which are used to store and manipulate binary data. The package is vulnerable to a malicious code injection that specifically targets the Ethereum cryptocurrency. The injected code performs unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in buffer-8or version 2.0.2 arises from the presence of malicious code within the package. This code specifically targets Ethereum transactions and attempts to steal funds by performing unauthorized transactions to external wallets. The impact of this vulnerability can result in financial loss for users who have Ethereum funds. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The buffer-8or package contains a critical vulnerability that allows malicious code to target Ethereum transactions and perform unauthorized transactions to external wallets. To mitigate this risk, it is recommended to remove the package from your environment and review Ethereum transactions for any unauthorized activity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buffer-8or →
FAQ
The malicious code within buffer-8or is designed to intercept Ethereum transactions made by the user. It performs unauthorized transactions to external wallets, diverting funds to the attacker's control.
The vulnerability exists in version 2.0.2 of buffer-8or. It is important to ensure that this version is not used in your application.
The potential ramifications of this vulnerability include financial loss for users who have Ethereum funds. Unauthorized transactions can result in the theft of funds, impacting the user's financial resources.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. It is crucial to take immediate action to mitigate the risk and protect Ethereum funds.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffer-8or.
