Executive brief
The bitcroe-lib npm package contained malware that steals cryptocurrency wallets and sensitive keys from infected systems. Any computer with this package installed is fully compromised and all stored secrets must be rotated from a clean device. While removing the package is necessary, complete remediation may require full system recovery due to the level of access the malware obtained.
Technical details
This is a supply-chain attack (CWE-506: Embedded Malicious Code) where all versions of the bitcroe-lib npm package contained malware. The package was designed to locate and exfiltrate cryptocurrency wallets and secret keys from the host system. The attack vector is network-based through the npm package manager, with no authentication or user interaction required beyond installing the package. Once installed, the malware gains full execution context within the Node.js runtime, allowing unrestricted access to the file system and secrets. There is no patch available; the only remediation is complete removal of the package and full system recovery, with cryptographic key rotation from an uncompromised device.
Affected products
- bitcroe-lib bitcroe-lib all versions
Timeline
- 2020-09-04: disclosed: Advisory published on OSV/GitHub
- 2020-08-31: advisory: GitHub reviewed and confirmed as malicious