Malicious Package in js-she3: Ethereum Funds Compromised
Summary
GHSA-f8jj-45fj-44r6: Malicious Package in js-she3. Affects js-she3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
js-she3 is an npm package used for Ethereum cryptocurrency transactions. It provides functionality for interacting with the Ethereum network and managing Ethereum funds. However, version 0.8.0 of js-she3 contained malicious code that targeted Ethereum funds and performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in js-she3 version 0.8.0 allowed attackers to compromise Ethereum funds. The malicious code within the package executed unauthorized transactions, transferring funds to wallets controlled by the attackers. This could result in financial loss for users who had installed and used the affected version of js-she3. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
Version 0.8.0 of js-she3 contained malicious code that targeted Ethereum funds and performed unauthorized transactions. Users are advised to remove the package from their environment and check for any compromised funds. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for js-she3 →
FAQ
js-she3 is an npm package used for Ethereum cryptocurrency transactions. It provides functionality for interacting with the Ethereum network and managing Ethereum funds.
Version 0.8.0 of js-she3 is the affected version that contains the malicious code.
The vulnerability allows attackers to compromise Ethereum funds and perform unauthorized transactions to wallets not controlled by the user. This can result in financial loss for affected users.
To fix this vulnerability, remove the js-she3 package from your environment and verify if any Ethereum funds were compromised. Take appropriate action to secure your funds and report any unauthorized transactions.
No workaround is available for this vulnerability. Removing the affected package is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-she3.
