Malicious Package in buffer-zor
Summary
GHSA-f294-27fc-wgj7: Malicious Package in buffer-zor. Affects buffer-zor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The buffer-zor package is an npm package that is part of the Ethereum cryptocurrency ecosystem. It provides functionality related to buffer operations. The package has been found to contain a vulnerability in version 2.0.2, where it included malicious code. This code targeted Ethereum cryptocurrency and performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in buffer-zor version 2.0.2 is a critical issue with a CVSS score of 9.8. The malicious code included in the package allows unauthorized transactions to be performed on the Ethereum cryptocurrency. This can result in financial loss for users who have installed and used the affected version of the package. The vulnerability originates from the inclusion of the malicious code in the package's source code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The buffer-zor package version 2.0.2 contains a critical vulnerability that allows unauthorized transactions on the Ethereum cryptocurrency. To mitigate this vulnerability, it is crucial to remove the package from your environment and verify that no funds have been compromised. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buffer-zor →
FAQ
Buffer-zor is an npm package that provides buffer operations functionality in the Ethereum cryptocurrency ecosystem.
Version 2.0.2 of buffer-zor is the affected version that contains the malicious code.
The vulnerability allows unauthorized transactions to be performed on the Ethereum cryptocurrency, potentially resulting in financial loss for users.
To fix the vulnerability, remove the buffer-zor package from your environment and ensure no Ethereum funds have been compromised.
No workaround is available for this vulnerability. It is recommended to remove the affected package.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffer-zor.
