Malicious Package in buffer-yor
Summary
GHSA-g2c4-4m64-vxm3: Malicious Package in buffer-yor. Affects buffer-yor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The buffer-yor package is an npm package used in JavaScript applications. It provides functionality related to buffer manipulation. The package is vulnerable to a critical security issue that was introduced in version 2.0.2. This version contained malicious code that specifically targeted the Ethereum cryptocurrency. The malicious code performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in buffer-yor version 2.0.2 allows an attacker to compromise Ethereum funds by executing unauthorized transactions. This can lead to financial losses for users who have installed and used this version of the package. The malicious code was designed to exploit the Ethereum ecosystem and perform transactions without the user's consent. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The buffer-yor package version 2.0.2 contains a critical vulnerability that allows unauthorized transactions targeting Ethereum wallets. Users are advised to remove the package from their environment and ensure no Ethereum funds have been compromised. It is important to take proactive measures to secure funds and report any incidents to the appropriate authorities. For further support and assistance, contact DevNack.com.
See every vulnerability recorded for buffer-yor →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this specific issue in buffer-yor.
If you have installed buffer-yor version 2.0.2, it is crucial to remove the package from your environment immediately. This will help mitigate the risk of unauthorized transactions and potential financial losses. After removing the package, review your Ethereum transaction history to ensure no unauthorized transactions have occurred.
Downgrading to a safe version of buffer-yor is not recommended as it may introduce other vulnerabilities or compatibility issues with your application. It is best to remove the package entirely and consider alternative solutions or updated versions that have addressed the security issue.
After removing buffer-yor, it is important to take additional steps to secure your Ethereum funds. This includes reviewing your wallet settings, enabling two-factor authentication, and regularly monitoring your transaction history for any suspicious activity. It is also advisable to keep your Ethereum software and wallets up to date with the latest security patches.
If you have experienced unauthorized transactions or believe you have been affected by this vulnerability, it is recommended to report the incident to the relevant authorities. Additionally, you can reach out to info@devnack.com for further support and guidance on vulnerability remediation.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffer-yor.
