Executive brief
The coinstrng npm package, distributed through the Node.js package registry, contained malware designed to steal cryptocurrency wallets and private keys from infected systems. Any computer with this package installed should be considered fully compromised, requiring immediate rotation of all secrets and keys from a clean system and complete system remediation, as removing the package alone may not eliminate all malicious components.
Technical details
This is a malicious software supply chain attack (CWE-506: Embedded Malicious Code). All versions of the coinstrng npm package from version 0.0.0 onward contained embedded malware with no legitimate functionality. The malware was designed to discover and exfiltrate cryptocurrency wallet credentials and private keys from the infected system. Installation via npm (network vector) requires no authentication or user interaction beyond the initial package download and require() call. An attacker gains full system compromise, enabling credential theft, lateral movement, and persistent access. The only mitigation is complete removal and system remediation; no patch is available for a malicious package.
Affected products
- npm coinstrng all versions
Timeline
- 2020-09-03: disclosed