Malicious Package in js-sla3: Ethereum Fund Theft
Summary
GHSA-h6m3-cx24-9626: Malicious Package in js-sla3. Affects js-sla3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-sla3 package is an npm package that is used in JavaScript projects. It provides functionality related to Ethereum cryptocurrency. It allows users to interact with the Ethereum blockchain, perform transactions, and manage Ethereum funds. However, a specific version of the package, version 0.8.0, contained malicious code that targeted Ethereum funds and performed unauthorized transactions to wallets not controlled by the user.
Vulnerability Detail
The vulnerability in the js-sla3 package version 0.8.0 allowed an attacker to steal Ethereum funds from users. The malicious code within the package executed unauthorized transactions, transferring the funds to wallets controlled by the attacker. This could result in financial loss for the affected users. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The js-sla3 package version 0.8.0 contained malicious code that targeted Ethereum funds and performed unauthorized transactions. To mitigate the vulnerability, it is crucial to remove the package from the environment and verify that no Ethereum funds were compromised. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for js-sla3 →
FAQ
You can use Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert Playground allows you to analyze your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
The vulnerability affects version 0.8.0 of the js-sla3 package.
The vulnerability can result in the theft of Ethereum funds from users. Unauthorized transactions can be executed, transferring the funds to wallets controlled by the attacker. This can lead to financial loss for the affected users.
Yes, the fix for this vulnerability is to remove the js-sla3 package from the environment. Users should uninstall the package using the package manager and ensure that no Ethereum funds were compromised.
The severity of this vulnerability is classified as critical, with a CVSS score of 9.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-sla3.
