Malicious Package in bufner-xor
Summary
GHSA-7xf6-cpxm-5mx9: Malicious Package in bufner-xor. Affects bufner-xor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The bufner-xor package is an npm package that is used in various JavaScript projects. It provides functionality related to XOR encryption and decryption. The package is commonly used in applications that require data encryption and decryption using XOR operations. However, version 2.0.2 of the package contained malicious code that targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user, potentially resulting in the loss of Ethereum funds.
Vulnerability Detail
The vulnerability in bufner-xor version 2.0.2 arises from the inclusion of malicious code. This code specifically targets the Ethereum cryptocurrency and performs unauthorized transactions to external wallets. The code bypasses user control and can lead to the loss of Ethereum funds. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. It is important to note that this vulnerability affects all versions of bufner-xor starting from 0.0.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The bufner-xor package version 2.0.2 contains malicious code that targets the Ethereum cryptocurrency and performs unauthorized transactions to external wallets. To ensure the security of your application and prevent potential loss of Ethereum funds, it is recommended to remove the package from your environment. Additionally, review your Ethereum wallets and transaction history to verify the integrity of your funds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bufner-xor →
FAQ
The malicious code in bufner-xor version 2.0.2 specifically targets the Ethereum cryptocurrency by performing unauthorized transactions to external wallets. It bypasses user control and can result in the loss of Ethereum funds.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. It is crucial to take immediate action to mitigate the risk and prevent potential loss of Ethereum funds.
All versions of bufner-xor starting from 0.0.0 are affected by this vulnerability. It is recommended to remove the package from your environment to ensure the security of your application.
To verify if your Ethereum funds were compromised, review your Ethereum wallets and transaction history. Look for any unauthorized transactions or suspicious activity. If you notice any discrepancies, take immediate action to secure your funds.
If you find unauthorized transactions in your Ethereum wallet, take immediate action to secure your funds. Contact your cryptocurrency exchange or wallet provider for assistance in recovering your funds and securing your account.
References
Related vulnerabilities
Recent vulnerabilities recorded for bufner-xor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
