Executive brief
bitconijs-lib is a JavaScript library for cryptocurrency wallet management. All versions of this package contained malware designed to locate and steal cryptocurrency wallets and keys from infected systems. Any system with this package installed should be considered fully compromised and all cryptographic keys and secrets stored on it should be immediately rotated from a different, clean system.
Technical details
This vulnerability is a supply-chain attack (CWE-506: Embedded Malicious Code). The entire npm package bitconijs-lib contained malware across all released versions designed to exfiltrate cryptocurrency wallets and keys. The attack vector is network-based, triggered upon package installation and execution in a Node.js environment. No authentication or special preconditions are required—installation of the package is sufficient for compromise. Once executed, the malware gains arbitrary code execution capabilities on the host system, enabling wallet theft and full system compromise. The malware has been removed from npm registry, but manual removal of the package does not guarantee removal of all implanted malicious software.
Affected products
- npm bitconijs-lib all versions
Timeline
- 2020-09-04: disclosed
- 2020-08-31: other: GitHub reviewed and confirmed malicious