Executive brief
The bitcoin-sweep npm package is a malicious library designed to steal cryptocurrency wallets and private keys from infected systems. Installation of this package gives attackers full control over the affected computer, and removal alone may not eliminate all malicious components, requiring complete system remediation and credential rotation from a clean device.
Technical details
All versions of the bitcoin-sweep npm package contained malware (CWE-506: Embedded Malicious Code) designed to discover and exfiltrate cryptocurrency wallets and cryptographic keys from the host system. Installation occurs via standard npm package manager without authentication requirements, and the malicious payload executes with the privileges of the installing user. Once installed, the malware grants attackers full system control, making removal unreliable and necessitating complete system remediation. No patch exists; the package should not be installed and should be immediately removed from all affected systems.
Affected products
- npm bitcoin-sweep all versions
Timeline
- 2020-09-04: disclosed