Malicious Package in jw-sha3
Summary
GHSA-8g3r-968r-c644: Malicious Package in jw-sha3. Affects jw-sha3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jw-sha3 is an npm package that provides SHA3 hashing functionality. It is commonly used in applications that require cryptographic operations, such as blockchain and cryptocurrency projects. The package allows users to generate SHA3 hashes of data using different hash lengths. However, version 0.8.0 of jw-sha3 contained malicious code that specifically targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user, potentially leading to the loss of Ethereum funds.
Vulnerability Detail
The vulnerability in jw-sha3 version 0.8.0 arises from the inclusion of malicious code. This code specifically targets Ethereum transactions and redirects them to unauthorized wallets. As a result, users who installed this version of jw-sha3 may have unknowingly compromised their Ethereum funds. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8, indicating a high level of impact and exploitability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, jw-sha3 version 0.8.0 contained malicious code that targeted Ethereum transactions, potentially leading to the loss of funds. It is crucial to remove this package from your environment and verify the integrity of your Ethereum funds. If you have been affected by unauthorized transactions, report the incident and take necessary actions to secure your accounts. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jw-sha3 →
FAQ
You can use Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert Playground allows you to analyze your package-lock.json file and provides real-time alerts for open-source vulnerabilities, including this specific issue with jw-sha3.
If you have installed jw-sha3 version 0.8.0, it is highly recommended to remove the package from your environment immediately. This will help mitigate the risk of unauthorized transactions and potential loss of Ethereum funds.
Recovering compromised Ethereum funds can be challenging. It is crucial to act quickly by reporting the incident to the appropriate authorities and taking necessary steps to secure your affected accounts. However, there is no guarantee of recovering the lost funds.
No, only version 0.8.0 of jw-sha3 is known to contain the malicious code. It is recommended to update to a secure version or consider alternative packages for SHA3 hashing functionality.
To prevent similar vulnerabilities, it is essential to follow best practices for package management. Regularly update your packages to the latest secure versions, review package dependencies for known vulnerabilities, and consider using tools like Vulert to monitor and receive real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for jw-sha3.
