Malicious Package in js-qha3
Summary
GHSA-vf5m-q45w-8mh9: Malicious Package in js-qha3. Affects js-qha3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-qha3 package is an npm package used in JavaScript applications. It provides functionality related to the Ethereum cryptocurrency. This package allows users to interact with the Ethereum network, perform transactions, and manage Ethereum wallets. However, version 0.8.0 of the package contained malicious code that targeted the Ethereum cryptocurrency. The code performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in the js-qha3 package arises from the inclusion of malicious code in version 0.8.0. This code specifically targets the Ethereum cryptocurrency and performs unauthorized transactions. As a result, users' Ethereum funds can be compromised, leading to financial losses. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-506.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The js-qha3 package version 0.8.0 contains malicious code that targets the Ethereum cryptocurrency and performs unauthorized transactions. To mitigate this vulnerability, it is crucial to remove the package from the environment and review Ethereum transaction history for any unauthorized activity. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for js-qha3 →
FAQ
The impact of this vulnerability is the potential compromise of users' Ethereum funds, leading to financial losses.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Version 0.8.0 of the js-qha3 package is affected by this vulnerability.
No, there are no known workarounds for this vulnerability. It is recommended to remove the package and review Ethereum transaction history for any unauthorized activity.
To prevent similar vulnerabilities, it is important to regularly update packages to the latest secure versions. Additionally, consider using security tools like Vulert to monitor and detect vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-qha3.
