Executive brief
The conistring npm package contained malware in all versions designed to steal cryptocurrency wallets from infected systems. Installation of this package grants attackers full control of the computer and exfiltration of sensitive cryptographic keys. Any system with this package installed should be considered compromised and all secrets must be rotated immediately from a different computer.
Technical details
This is a supply-chain attack involving a malicious npm package (CWE-506: Embedded Malicious Code). All versions of conistring contained wallet-stealing malware that runs upon installation or execution. The attack vector is network-based—users installing the package from npm registry trigger the malware. No authentication or preconditions are required; the exploit is automatic upon package installation. The malware achieves remote code execution and data exfiltration of cryptocurrency wallets and secrets. There is no patch available; the package should be removed entirely, though full system compromise means removal may not eliminate all backdoors.
Affected products
- npm conistring all versions
Timeline
- 2020-09-03: disclosed
- 2020-09-03: advisory