Executive brief
The cionstring npm package is malware designed to steal cryptocurrency wallets and exfiltrate secrets from infected systems. Any computer with this package installed should be considered fully compromised, and all credentials, keys, and cryptocurrency assets stored on that system must be immediately rotated from a clean device.
Technical details
All versions of the cionstring npm package contained embedded malware (CWE-506: Embedded Malicious Code). The package was intentionally designed to locate and exfiltrate cryptocurrency wallets and other sensitive secrets from the host system. Installation occurs via npm package manager (network vector), requires no authentication or user interaction, and grants the attacker arbitrary code execution during installation and runtime. The malware provides the attacker with full control over the compromised system; removal of the package alone does not guarantee elimination of all malicious artifacts, as the attacker may have established persistence mechanisms.
Affected products
- npm cionstring all versions
Timeline
- 2020-09-03: disclosed