Malicious Package in buffer-xob
Summary
GHSA-gpg2-7r7j-4pm9: Malicious Package in buffer-xob. Affects buffer-xob versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The buffer-xob package is an npm package used in JavaScript applications. It provides functionality for handling buffers and is commonly used in various projects. However, a specific version of the package, version 2.0.2, was found to contain malicious code. This code targeted the Ethereum cryptocurrency and performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in buffer-xob version 2.0.2 allowed an attacker to compromise Ethereum funds by executing unauthorized transactions. The malicious code within the package was designed to target Ethereum wallets and perform transactions without the user's consent. This could result in financial loss for the affected users. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The buffer-xob package version 2.0.2 contained malicious code that targeted Ethereum wallets and performed unauthorized transactions. To mitigate this vulnerability, it is crucial to remove the affected package and review Ethereum wallet transactions for any unauthorized activity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buffer-xob →
FAQ
Buffer-xob is an npm package used for handling buffers in JavaScript applications. It provides functionality for working with binary data.
The specific version affected by this vulnerability is 2.0.2.
The malicious code targeted Ethereum wallets and performed unauthorized transactions, potentially resulting in financial loss for the affected users.
To fix this vulnerability, remove the buffer-xob package from your environment and review your Ethereum wallet transactions for any unauthorized activity.
No specific workaround is mentioned for this vulnerability. Removing the affected package is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffer-xob.
