Executive brief
The bitcoimd-rpc npm package, which developers use to interact with Bitcoin daemon nodes, contained malware in all versions. The malware was designed to find and steal cryptocurrency wallets and private keys from infected machines. Any computer with this package installed should be considered completely compromised, and all cryptocurrency keys and secrets must be rotated from a clean system immediately.
Technical details
This is a malicious package attack (CWE-506) in which the npm library bitcoimd-rpc was intentionally published with wallet-stealing malware. All versions from 0.0.0 onward contained the malicious code. The attack requires installation and execution of the package, which network-connected developers may have done via npm install. The malware searches for and exfiltrates cryptocurrency wallets and private keys. Due to the nature of supply-chain compromise, no patched version exists; the package must be completely removed and replaced with a legitimate alternative or custom implementation.
Affected products
- npm bitcoimd-rpc all versions (0.0.0 and later)
Timeline
- 2020-09-04: disclosed