GitHub Advisoryadvisory · npm

GHSA-jvfv-jhw9-jmpp Malicious Package in b5ffer-xor

CRITICAL Published 2020-09-03 Modified 2021-09-29 Official page ↗
Ecosystem
npm
Packages
b5ffer-xor
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-506
Reviewed
2020-08-31

Affected packages

• npm b5ffer-xor: >= 0.0.0 (no fix yet)

Description

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References