Malicious Package in ns-sha3
Summary
GHSA-j67m-jg9p-ppg4: Malicious Package in ns-sha3. Affects ns-sha3 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ns-sha3 package is an npm package used for cryptographic hashing in Node.js applications. It provides a convenient interface for generating SHA-3 hashes. However, version 0.8.0 of the package contained malicious code that specifically targeted the Ethereum cryptocurrency. This code performed unauthorized transactions to wallets not controlled by the user, potentially leading to the compromise of Ethereum funds.
Vulnerability Detail
The vulnerability in ns-sha3 version 0.8.0 arises from the inclusion of malicious code. This code specifically targets Ethereum transactions and attempts to transfer funds to unauthorized wallets. The impact of this vulnerability can be severe, as it can result in the loss of Ethereum funds for affected users. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The ns-sha3 package version 0.8.0 contained malicious code that targeted Ethereum transactions, potentially leading to the compromise of funds. It is critical to remove this package from your environment and ensure the integrity of your Ethereum wallets. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ns-sha3 →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The Vulert Playground allows you to analyze your package-lock.json file and provides real-time monitoring and alerts for open-source vulnerabilities.
If your application is affected by this vulnerability, you should immediately remove the ns-sha3 package from your environment. Additionally, review your Ethereum wallets and transaction history to ensure no funds have been compromised.
Yes, there are alternative packages available for cryptographic hashing in Node.js. It is recommended to use well-maintained and trusted packages from reputable sources. Conduct thorough research and consider community feedback before adopting any alternative package.
Yes, the malicious code has been removed in newer versions of ns-sha3. It is crucial to update to the latest version of the package to ensure the vulnerability is mitigated. Always keep your dependencies up to date to benefit from security fixes and improvements.
To prevent similar vulnerabilities, it is essential to follow best practices for package management. Regularly update your dependencies to incorporate security patches and bug fixes. Additionally, consider using tools like Vulert to monitor and receive real-time alerts for open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for ns-sha3.
