Malicious Package in cuffer-xor: Unauthorized Ethereum Transactions
Summary
GHSA-6xm4-p6r2-mwrc: Malicious Package in cuffer-xor. Affects cuffer-xor versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cuffer-xor is an npm package that provides functionality related to Ethereum cryptocurrency. It is used to perform various operations such as transaction signing and wallet management. However, version 2.0.2 of cuffer-xor contained malicious code that targeted Ethereum funds and performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The malicious code present in cuffer-xor version 2.0.2 posed a significant security risk to users. It exploited the package's access to Ethereum funds and initiated transactions without the user's consent. This could result in financial losses for the affected users. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of malicious code in cuffer-xor version 2.0.2 poses a critical security risk to users of the package. It is essential to take immediate action by removing the affected package, verifying Ethereum wallets, and updating to a secure version. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cuffer-xor →
FAQ
cuffer-xor is an npm package used for Ethereum cryptocurrency operations such as transaction signing and wallet management.
Version 2.0.2 of cuffer-xor is the version that contains the malicious code.
The malicious code in cuffer-xor version 2.0.2 targets Ethereum funds and performs unauthorized transactions to wallets not controlled by the user.
The vulnerability can lead to financial losses for users as their Ethereum funds can be transferred to unauthorized wallets.
To protect yourself, remove cuffer-xor version 2.0.2 from your environment, verify your Ethereum wallets and transactions, and update to a secure version of the package when available.
References
Related vulnerabilities
Recent vulnerabilities recorded for cuffer-xor.
