Malicious Package in buffer-xgr
Summary
GHSA-mp55-2274-4pj8: Malicious Package in buffer-xgr. Affects buffer-xgr versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The buffer-xgr package is an npm package used in JavaScript applications. It provides functionality for handling buffers and is commonly used in projects that require low-level binary data manipulation. The package is vulnerable to a critical security issue that was introduced in version 2.0.2.
Vulnerability Detail
The vulnerability in buffer-xgr version 2.0.2 is due to the presence of malicious code. This code specifically targets the Ethereum cryptocurrency and performs unauthorized transactions to wallets not controlled by the user. The impact of this vulnerability can result in the compromise of Ethereum funds. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The buffer-xgr package version 2.0.2 contains a critical vulnerability that allows unauthorized transactions on Ethereum wallets. It is recommended to remove the package from your environment and review your transaction history to ensure the security of your funds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buffer-xgr →
FAQ
Buffer-xgr is an npm package used for handling buffers in JavaScript applications. It provides functions for manipulating binary data.
The vulnerability allows unauthorized transactions to be performed on Ethereum wallets, potentially leading to the compromise of funds.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and you can analyze your package-lock.json file to identify any vulnerable dependencies.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
If you have been using buffer-xgr version 2.0.2, it is important to review your transaction history and ensure that no unauthorized transactions have occurred. You should also consider moving your funds to a secure wallet and taking necessary precautions to protect your private keys.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffer-xgr.
