Malicious Package in ks-sha3
Summary
GHSA-563h-49v8-g7x4: Malicious Package in ks-sha3. Affects ks-sha3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ks-sha3 package is an npm package used for cryptographic hashing in JavaScript applications. It provides a SHA-3 implementation, which is a cryptographic hash function. The package is commonly used in projects that require secure hashing of data, such as blockchain applications. However, version 0.8.0 of the ks-sha3 package contained malicious code that targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user, potentially compromising Ethereum funds.
Vulnerability Detail
The vulnerability in version 0.8.0 of the ks-sha3 package allowed an attacker to execute unauthorized transactions on the Ethereum network. By including malicious code in the package, the attacker could gain control over the user's Ethereum funds and transfer them to their own wallets. This vulnerability posed a significant risk to users who were using the affected version of the package. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
Version 0.8.0 of the ks-sha3 package contained malicious code that targeted the Ethereum cryptocurrency and performed unauthorized transactions. To mitigate this vulnerability, it is crucial to remove the affected package, check for any unauthorized transactions, and take steps to secure your Ethereum funds. Regularly updating packages and staying informed about security advisories can help prevent similar vulnerabilities in the future. For further support, you can contact DevNack.com.
See every vulnerability recorded for ks-sha3 →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this specific vulnerability in the ks-sha3 package.
If you find that your application is affected by this vulnerability, you should immediately remove the ks-sha3 package from your environment. Additionally, you should check for any unauthorized transactions made from your Ethereum wallets and take appropriate action to secure your funds.
Yes, there are several alternative packages available for cryptographic hashing in JavaScript. Some popular options include crypto-js, bcrypt, and sha.js. It is recommended to choose a package with a good track record of security and regularly updated to address any vulnerabilities.
To prevent similar vulnerabilities in the future, it is important to regularly update your packages to the latest versions. Stay informed about any security advisories or vulnerability reports related to the packages you are using. Consider using a package management tool that can automatically check for and update vulnerable packages.
For further support on vulnerability remediation and securing your application, you can reach out to info@devnack.com. Our team of experts can provide guidance and assistance in addressing vulnerabilities and improving the security of your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for ks-sha3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
