Malicious Package in buffev-xor
Summary
GHSA-x3w4-mrmv-cw2x: Malicious Package in buffev-xor. Affects buffev-xor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
buffev-xor is an npm package that provides functionality for XOR encryption and decryption. It is commonly used in various applications that require data encryption. However, version 2.0.2 of the package contained malicious code that specifically targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user, potentially leading to the loss of Ethereum funds.
Vulnerability Detail
The vulnerability in buffev-xor version 2.0.2 allowed attackers to exploit the package and perform unauthorized transactions with Ethereum funds. This was achieved through the inclusion of malicious code within the package. The code specifically targeted Ethereum wallets and executed transactions without the user's consent. The impact of this vulnerability could result in financial loss for users who had installed and used the affected version of the package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of malicious code in version 2.0.2 of the buffev-xor package posed a significant risk to users' Ethereum funds. To mitigate this vulnerability, it is crucial to remove the affected package from your environment and ensure that no unauthorized transactions have occurred. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buffev-xor →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes the package-lock.json file to identify and alert in real-time for open-source vulnerabilities. No signup is required to use the playground.
The vulnerability exists in version 2.0.2 of the buffev-xor package.
The potential consequences of this vulnerability include the loss of Ethereum funds due to unauthorized transactions. Users who have installed and used version 2.0.2 of buffev-xor may have experienced financial loss if their Ethereum wallets were targeted.
Yes, it is recommended to update to the latest version of buffev-xor to ensure that the malicious code is no longer present. Developers have addressed this vulnerability in later versions of the package.
If you suspect unauthorized transactions in your Ethereum wallet, it is important to take immediate action. Contact the relevant authorities, such as your cryptocurrency exchange or wallet provider, to report the incident and seek assistance in securing your funds. Additionally, consider consulting blockchain security experts for further guidance.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffev-xor.
