Malicious Package in js-shq3 - Critical Vulnerability
Summary
GHSA-766v-7gjx-55hf: Malicious Package in js-shq3. Affects js-shq3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-shq3 package is an npm package used in JavaScript applications. It provides functionality related to the Ethereum cryptocurrency. The package allows users to interact with the Ethereum network, perform transactions, and manage Ethereum wallets. However, version 0.8.0 of the package contained malicious code that targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in the js-shq3 package arises from the inclusion of malicious code in version 0.8.0. This code specifically targets the Ethereum cryptocurrency and performs unauthorized transactions. As a result, users' Ethereum funds may be compromised if they have installed and used this version of the package. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the js-shq3 package version 0.8.0 contains malicious code that targets the Ethereum cryptocurrency and performs unauthorized transactions. To mitigate this critical vulnerability, it is crucial to remove the package from your environment and ensure that no Ethereum funds have been compromised. For additional support and guidance, you can reach out to DevNack.com.
See every vulnerability recorded for js-shq3 →
FAQ
The impact of this vulnerability is that users' Ethereum funds may be compromised due to unauthorized transactions performed by the malicious code in the js-shq3 package.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and Vulert will analyze it for open-source vulnerabilities in real-time.
Version 0.8.0 of the js-shq3 package is the version that contains the malicious code and is affected by this vulnerability.
No, there are no known workarounds for this vulnerability. The recommended solution is to remove the js-shq3 package from your environment.
Yes, for further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-shq3.
