Malicious Package in jsmsha3
Summary
GHSA-657v-jjf8-83gh: Malicious Package in jsmsha3. Affects jsmsha3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsmsha3 package is an npm package that provides a JavaScript implementation of the SHA-3 cryptographic hash function. It is commonly used in applications that require secure hashing of data. However, version 0.8.0 of the package contained malicious code that specifically targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user, potentially leading to the loss of Ethereum funds.
Vulnerability Detail
The vulnerability in jsmsha3 version 0.8.0 allowed an attacker to compromise the integrity and security of Ethereum transactions. By injecting malicious code into the package, the attacker was able to redirect funds to their own wallets, bypassing user control. This posed a significant risk to users relying on jsmsha3 for secure Ethereum transactions. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The jsmsha3 package version 0.8.0 contained malicious code that targeted Ethereum transactions, potentially leading to the loss of funds. To mitigate this vulnerability, it is crucial to remove the affected package version, verify the integrity of Ethereum funds, and consider updating to a secure version. For additional support, contact DevNack.com.
See every vulnerability recorded for jsmsha3 →
FAQ
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
The impact of this vulnerability is the potential loss of Ethereum funds. The malicious code in jsmsha3 version 0.8.0 can perform unauthorized transactions to wallets not controlled by the user, allowing an attacker to steal funds.
No, only version 0.8.0 of jsmsha3 is affected by this vulnerability. It is recommended to remove this version and update to a secure version, if available.
There is no known workaround for this vulnerability. The best course of action is to remove the affected version of jsmsha3 and take necessary steps to ensure the security of Ethereum funds.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for jsmsha3.
