Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZ4ZzItY2Y2aC14NHY4

Critical
Permalink JSON

Malicious Package in buffer-por

Affected Packages Affected Versions Fixed Versions
npm:buffer-por
PURL: pkg:npm/buffer-por
>= 0.0.0 No known fixed version
1 Dependent packages
1 Dependent repositories
2 Downloads last month

Affected Version Ranges

All affected versions

0.0.1-security

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.

Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

References:

Identifiers

GHSA-6xg2-cf6h-x4v8

Risk

Severity

Critical

Classification

General

Source

GitHub Advisory Database

Origin

Unspecified

Date and time

Published

about 5 years ago

Updated

almost 3 years ago

API

JSON