Executive brief
The bip30 npm package, used for cryptocurrency wallet operations, was compromised and distributed with malware designed to find and exfiltrate cryptocurrency wallets. Any system with this package installed should be considered fully compromised, and all cryptographic keys and secrets stored on that system must be rotated immediately from a different, unaffected computer. Complete removal cannot be guaranteed without forensic analysis.
Technical details
This vulnerability is a malicious package incident (CWE-506: Embedded Malicious Code) where all versions of the bip30 npm library were found to contain wallet-stealing malware. The attack vector is local execution upon installation and import; no network vulnerability or authentication bypass is involved—instead, the malware runs with the privileges of the node process that requires the package. The malware actively searches for and exfiltrates stored cryptocurrency wallets and keys. Because the package is a direct dependency, any developer or application that installed it is at risk. There is no patch for this vulnerability; the only remediation is complete removal and rotation of all affected secrets.
Affected products
- npm bip30 all versions
Timeline
- 2020-09-04: disclosed: Malicious package advisory published