Malicious Package in js-rha3
Summary
GHSA-95cg-3r4g-7w6j: Malicious Package in js-rha3. Affects js-rha3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-rha3 package is an npm package used in JavaScript applications. It provides functionality related to the Ethereum cryptocurrency. The package allows users to interact with the Ethereum network, perform transactions, and manage Ethereum wallets. However, version 0.8.0 of the package contained malicious code that targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in the js-rha3 package (version 0.8.0) allowed an attacker to compromise Ethereum funds. The malicious code included in the package executed unauthorized transactions, transferring funds to wallets controlled by the attacker. This could result in financial loss for users who had installed and used the affected version of the package. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The js-rha3 package (version 0.8.0) contained malicious code that targeted Ethereum funds and performed unauthorized transactions. To mitigate the risk, it is recommended to remove the package from your environment and review Ethereum wallet transactions for any unauthorized activity. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for js-rha3 →
FAQ
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert Playground allows you to analyze your package-lock.json file and provides real-time monitoring and alerts for open-source vulnerabilities in your software.
Version 0.8.0 of the js-rha3 package is affected by this vulnerability. It is recommended to remove this version from your environment.
Yes, the malicious code included in version 0.8.0 of the js-rha3 package can perform unauthorized transactions and transfer Ethereum funds to wallets controlled by the attacker. It is important to review your Ethereum wallet transactions and ensure no unauthorized transactions have occurred.
Yes, the fix for this vulnerability is to remove the js-rha3 package from your environment. Make sure to uninstall the affected version (0.8.0) and consider using a trusted alternative package for interacting with the Ethereum network.
This vulnerability has a CVSS score of 9.8, indicating its critical severity. It is crucial to take immediate action to remove the affected package and review Ethereum wallet transactions for any unauthorized activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-rha3.
