Executive brief
bictoin-ops is an npm package that was published with intentional malware designed to steal cryptocurrency wallets and private keys from infected systems. Installation of this package gives attackers full control over the compromised computer, allowing them to exfiltrate secrets and potentially gain access to cryptocurrency holdings and other sensitive assets.
Technical details
This is a supply-chain attack involving a deliberately malicious npm package (CWE-506: Embedded Malicious Code). All versions of bictoin-ops from 0.0.0 onward contained malware coded to discover and exfiltrate cryptocurrency wallets and associated keys. The package is delivered via the npm package manager, and infection occurs upon installation and execution. Once installed, the malware grants remote attackers full system compromise. No patch is available because the package itself is malicious; the only remediation is complete removal and re-imaging of affected systems, combined with rotation of all cryptographic material from a clean computer.
Affected products
- npm bictoin-ops all versions (from 0.0.0)
Timeline
- 2020-09-04: disclosed: Vulnerability published to GitHub Advisory Database
- 2020-08-31: other: Advisory reviewed by GitHub