Executive brief
bitcoimjs-lib is a JavaScript library for Bitcoin wallet operations. All versions of this package contained malware designed to steal cryptocurrency wallets and private keys from infected systems. Any computer running this package should be considered fully compromised, and all cryptographic keys and secrets must be rotated immediately from a different, clean system.
Technical details
This is a supply-chain attack via a malicious npm package (CWE-506: Embedded Malicious Code). All versions of bitcoimjs-lib from 0.0.0 onwards contained intentional malware designed to locate and exfiltrate cryptocurrency wallets and private keys. The attack vector is network-based (npm installation), with no authentication required—an attacker need only trick developers into installing the package. Upon execution, the malware grants the attacker full control of the host system, potentially enabling deployment of additional backdoors or persistent threats.
Affected products
- npm bitcoimjs-lib all versions (0.0.0+)
Timeline
- 2020-09-04: disclosed