Executive brief
The bitcion-ops package is a malicious npm library designed to steal cryptocurrency wallets and related secrets from infected systems. Any computer with this package installed should be considered fully compromised, as the malware gives external attackers complete control and may persist even after removal.
Technical details
This is a malicious package (CWE-506: Embedded Malicious Code) distributed via npm that targets cryptocurrency wallets and secrets stored on the host system. All versions of bitcion-ops contained the malware with no known patched versions. The attack vector is supply-chain/installation-based: developers who install and run this package execute the malware with the privileges of their user account, allowing data exfiltration and potential system compromise. Since the malware may have modified the system beyond the package itself, complete remediation requires full system analysis and secret rotation from a clean machine.
Affected products
- npm bitcion-ops all versions
Timeline
- 2020-09-04: disclosed: Malicious package discovered and advisory published