Malicious Package in js-3ha3: Ethereum Funds Compromised
Summary
GHSA-52c9-458g-whrf: Malicious Package in js-3ha3. Affects js-3ha3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-3ha3 package is an npm package that is part of the JavaScript ecosystem. It is used for various purposes in JavaScript applications. However, version 0.8.0 of the package contained malicious code that specifically targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user, resulting in the compromise of Ethereum funds.
Vulnerability Detail
The vulnerability in the js-3ha3 package arises from the inclusion of malicious code in version 0.8.0. This code specifically targets Ethereum transactions and redirects them to unauthorized wallets. As a result, users who have this version of the package installed in their environment are at risk of having their Ethereum funds stolen. The severity of this vulnerability is classified as CRITICAL with a CVSS score of 9.8, indicating a high level of impact and exploitability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The js-3ha3 package version 0.8.0 contains malicious code that targets Ethereum transactions, resulting in the compromise of Ethereum funds. To mitigate this vulnerability, it is crucial to remove the package from the environment and review transaction history. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for js-3ha3 →
FAQ
The js-3ha3 package is an npm package used in JavaScript applications for various purposes.
Version 0.8.0 of the js-3ha3 package is affected by this vulnerability.
The impact of this vulnerability is the compromise of Ethereum funds, as unauthorized transactions are performed to wallets not controlled by the user.
To fix this vulnerability, remove the js-3ha3 package from your environment and review your Ethereum transaction history for any unauthorized transactions.
No specific workaround is mentioned for this vulnerability. The recommended action is to remove the package and verify transaction history.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-3ha3.
