Malicious Package in buffer-xmr
Summary
GHSA-5327-gfq5-8f4m: Malicious Package in buffer-xmr. Affects buffer-xmr versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The buffer-xmr package is an npm package used for working with Monero cryptocurrency. It provides functions for creating and manipulating Monero transactions. The package is vulnerable to a malicious code injection that specifically targets the Ethereum cryptocurrency. The injected code performs unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability originates from version 2.0.2 of the buffer-xmr package, which contains the malicious code. When this version is used, it poses a critical risk to Ethereum funds as it can perform unauthorized transactions. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. It is categorized under CWE-506. The malicious code can compromise the security and integrity of Ethereum transactions, potentially leading to financial loss for the users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to remove the affected package and follow the recommended steps for fixing the vulnerability.
Conclusion
The buffer-xmr package version 2.0.2 contains malicious code that targets Ethereum cryptocurrency. This vulnerability poses a critical risk to Ethereum funds and can lead to unauthorized transactions. It is important to remove the affected package and ensure the safety of Ethereum funds. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for buffer-xmr →
FAQ
Buffer-xmr is an npm package used for working with Monero cryptocurrency. It provides functions for creating and manipulating Monero transactions.
The vulnerability allows unauthorized transactions to be performed on Ethereum wallets, potentially leading to financial loss for the users.
Version 2.0.2 of the buffer-xmr package is affected by this vulnerability.
To fix this vulnerability, remove the buffer-xmr package from your environment and ensure that no Ethereum funds were compromised.
There is no specific workaround mentioned for this vulnerability. Removing the affected package is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffer-xmr.
