Executive brief
bs58chekc is a malicious npm package designed to steal cryptocurrency wallets from infected computers. All versions of the package contained malware that searches for and exfiltrates cryptographic keys and secrets. Any computer that installed this package should be considered fully compromised, and all secrets, keys, and credentials stored on that system must be rotated immediately from a different, uncompromised device.
Technical details
This is a deliberate supply-chain attack (CWE-506: Embedded Malicious Code) delivered through the npm package manager. The malware is embedded in all versions of the bs58chekc package (starting from 0.0.0) and executes automatically upon installation or runtime. The attack vector is local installation via npm; no network access or authentication bypass is required—installation itself triggers the malicious payload. An attacker gains full control of the affected system and can harvest stored cryptocurrency wallets, private keys, and other secrets. Removal of the package does not guarantee removal of all malicious software, as the attacker may have established additional persistence mechanisms during initial compromise.
Affected products
- npm bs58chekc all versions
Timeline
- 2020-09-03: disclosed