Executive brief
The bitcionjs npm package contained malware designed to find and steal cryptocurrency wallets and private keys from infected systems. Any computer with this package installed should be considered fully compromised, and all cryptographic secrets must be regenerated from a secure system. The malware may have given an external attacker complete control over the compromised machine.
Technical details
All versions of the bitcionjs npm package contained deliberately injected malicious code (CWE-506: Embedded Malicious Code) that performed reconnaissance and exfiltration of cryptocurrency wallets and keys stored on the host system. The package could be installed directly via npm, making the attack vector network-based with no authentication or user interaction required beyond the initial installation. An attacker could achieve complete system compromise and theft of cryptographic material. The malware has not been publicly exploited in the wild at the time of disclosure, but the threat is fundamentally un-patchable without full system remediation, as the attacker may have established persistent access.
Affected products
- npm bitcionjs all versions
Timeline
- 2020-09-04: disclosed: Published in GitHub Advisory Database