Executive brief
The commandre npm package contained malware designed to locate and steal cryptocurrency wallets from infected systems. Any computer with this package installed should be considered fully compromised, and all cryptographic credentials stored on it must be rotated immediately from a different, unaffected machine.
Technical details
This npm package contained intentionally malicious code (CWE-506: embedded malware) that targeted cryptocurrency wallet discovery and exfiltration. All versions from 0.0.0 onwards were affected. The attack vector is network-based, occurring at installation time when a developer or system fetches and executes the package. No authentication or user interaction beyond installation is required. Exploitation grants the attacker full control over the compromised system and access to stored cryptocurrency credentials. The package should be removed, though complete remediation requires assuming additional malicious components may persist.
Affected products
- npm commandre 0.0.0 and all versions
Timeline
- 2020-09-03: disclosed: Advisory published