Malicious Package in buffer-hor
Summary
GHSA-wh87-3959-vfrq: Malicious Package in buffer-hor. Affects buffer-hor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The buffer-hor package is an npm package that is used in various JavaScript projects. It provides functionality related to buffers. The package is vulnerable to a critical security issue that was introduced in version 2.0.2. This version contained malicious code that targeted the Ethereum cryptocurrency. It performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in buffer-hor version 2.0.2 allows an attacker to compromise Ethereum funds by executing unauthorized transactions. The malicious code within the package specifically targets Ethereum wallets and performs transactions to wallets controlled by the attacker. This can result in financial loss for the users who have installed and used the affected version of the package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The buffer-hor package version 2.0.2 contains a critical vulnerability that allows unauthorized transactions on Ethereum wallets. It is crucial to remove the package from your environment and review your Ethereum wallet transactions for any suspicious activity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buffer-hor →
FAQ
Buffer-hor is an npm package used for handling buffers in JavaScript projects.
Version 2.0.2 of buffer-hor is affected by the vulnerability.
The vulnerability allows unauthorized transactions to be performed on Ethereum wallets, potentially resulting in financial loss for the users.
To fix this vulnerability, remove the buffer-hor package from your environment and review your Ethereum wallet transactions for any unauthorized activity.
No specific workaround is available for this vulnerability. Removing the affected package is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffer-hor.
