Malicious Package in buffer-xkr
Summary
GHSA-rw53-q8x7-ccx8: Malicious Package in buffer-xkr. Affects buffer-xkr versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The buffer-xkr package is an npm package used in JavaScript applications. It provides functionality related to buffers, which are used for handling binary data. The package is vulnerable to a malicious code injection attack.
Vulnerability Detail
Version 2.0.2 of the buffer-xkr package contained malicious code. The code specifically targeted the Ethereum cryptocurrency and performed unauthorized transactions to wallets not controlled by the user. This could lead to financial loss and compromise the security of Ethereum funds.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The buffer-xkr package version 2.0.2 contains malicious code that targets Ethereum wallets. It is crucial to remove the package from your environment and verify that no Ethereum funds were compromised. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buffer-xkr →
FAQ
Buffer-xkr is an npm package used for handling binary data in JavaScript applications.
Version 2.0.2 of buffer-xkr is affected by the malicious code injection vulnerability.
The vulnerability allows unauthorized transactions to be performed on Ethereum wallets, potentially leading to financial loss and compromised security.
To fix this vulnerability, remove the buffer-xkr package from your environment and ensure that no Ethereum funds were compromised.
No workaround is available for this vulnerability. Removing the package is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffer-xkr.
