Executive brief
bconi is a JavaScript library distributed via npm that contains malware designed to steal cryptocurrency wallets and other secrets from compromised systems. Installation of this package gives attackers complete control over the affected machine, enabling theft of financial assets and credentials. Any system with this package installed should be considered fully compromised and rebuilt from clean media.
Technical details
bconi is a malicious npm package (CWE-506: Embedded Malicious Code) that exfiltrates cryptocurrency wallets and credentials from infected systems. All versions of the package from 0.0.0 onwards contained the malware payload. The attack vector is network-based: developers pulling the package via npm during dependency installation trigger automatic execution of malicious code. No authentication or user interaction is required beyond the initial npm install command. Compromise results in complete system control and data exfiltration. No patch is available; the only remediation is removal of the package and full system rebuild.
Affected products
- npm bconi all versions (0.0.0 and later)
Timeline
- 2020-09-04: disclosed