Executive brief
The bpi66 npm package contained malware designed to steal cryptocurrency wallets from infected systems. Any computer with this package installed should be considered fully compromised, and all stored secrets and cryptographic keys must be immediately rotated from a clean machine. Removing the package provides no guarantee of complete malware removal, as the attacker may have gained persistent system access.
Technical details
This is a supply-chain attack via a malicious npm package (CWE-506: Embedded Malicious Code). All versions of bpi66 from version 0.0.0 onward contained malware with no known legitimate functionality. The package was designed to discover and exfiltrate cryptocurrency wallets and related secrets from the host system. The attack vector is network-based—any developer or CI/CD system that installed this package from the npm registry would execute the malicious payload. No authentication or user interaction was required beyond the installation itself. An attacker achieving code execution on a developer machine or build system gains full compromise, enabling theft of cryptographic credentials and potential access to cryptocurrency accounts and wallets.
Affected products
- npm bpi66 all versions from 0.0.0 onwards
Timeline
- 2020-09-04: disclosed