GHSA-jvfv-jhw9-jmpp

Source

https://github.com/advisories/GHSA-jvfv-jhw9-jmpp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-jvfv-jhw9-jmpp/GHSA-jvfv-jhw9-jmpp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jvfv-jhw9-jmpp

Published

2020-09-03T21:23:09Z

Modified

2021-09-29T20:22:21Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Malicious Package in b5ffer-xor

Details

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.

Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Database specific

{
    "cwe_ids": [
        "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:51:32Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
}

References

https://www.npmjs.com/advisories/1228

Affected packages

npm / b5ffer-xor

Package

Name: b5ffer-xor; View open source insights on deps.dev
Purl: pkg:npm/b5ffer-xor

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-jvfv-jhw9-jmpp/GHSA-jvfv-jhw9-jmpp.json"