Executive brief
babel-loadre is a JavaScript library package distributed via npm. All versions contained malware designed to steal cryptocurrency wallets and other sensitive data from compromised systems. Any system with this package installed should be considered fully compromised, and all secrets, keys, and credentials should be rotated immediately from a clean machine.
Technical details
This is a malicious package vulnerability (CWE-506: Embedded Malicious Code) where all versions of babel-loadre contained intentional malware rather than legitimate library functionality. The package was designed to locate and exfiltrate cryptocurrency wallets and other sensitive data from the host system. As a JavaScript npm package, it executes with the privileges of the node process and user who installed it. An attacker can achieve complete compromise of the affected system, including installation of additional malware. No patch is available; the entire package should be considered malicious and must be removed.
Affected products
- babel-loadre all versions
Timeline
- 2020-09-04: disclosed