Malicious Package in buffmr-xor - Ethereum Fund Theft
Summary
GHSA-wv39-cgmm-cq29: Malicious Package in buffmr-xor. Affects buffmr-xor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
buffmr-xor is an npm package that provides functionality for XOR operations on buffers. It is commonly used in Node.js applications for cryptographic operations and data manipulation. The package is designed to perform XOR operations efficiently and securely. However, a specific version of the package, 2.0.2, was found to contain malicious code that targeted the Ethereum cryptocurrency. This code executed unauthorized transactions to wallets not controlled by the user, potentially resulting in the theft of Ethereum funds.
Vulnerability Detail
The vulnerability in version 2.0.2 of buffmr-xor allowed an attacker to gain control over Ethereum transactions performed by the package. By injecting malicious code, the attacker could redirect funds to their own wallets, bypassing user authorization. This vulnerability posed a significant risk to users relying on the package for Ethereum-related operations. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of a malicious package in buffmr-xor version 2.0.2 posed a critical vulnerability to users relying on this package for Ethereum-related operations. To mitigate this risk, it is crucial to remove the affected version and update to a secure release. Additionally, it is recommended to verify that no Ethereum funds were compromised during the period when the malicious package was in use. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buffmr-xor →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes the package-lock.json file to identify vulnerable dependencies and provides real-time alerts for open-source vulnerabilities.
The consequences of this vulnerability include the potential theft of Ethereum funds. If your application uses buffmr-xor version 2.0.2, unauthorized transactions may have been performed, redirecting funds to wallets controlled by the attacker.
No, there is no known workaround for this vulnerability. It is crucial to remove the affected version of buffmr-xor and update to a secure version as soon as possible.
Yes, there are alternative packages available for performing XOR operations on buffers in Node.js. Some popular options include 'buffer-xor' and 'xor-buffer'. It is recommended to evaluate these alternatives and choose a package with a good track record of security and reliability.
To ensure the security of your Ethereum funds, it is essential to regularly review and update the packages used in your application. Stay informed about any reported vulnerabilities and promptly apply fixes or updates. Additionally, consider implementing additional security measures such as multi-factor authentication and secure storage of private keys.
References
Related vulnerabilities
Recent vulnerabilities recorded for buffmr-xor.
