Executive brief
The dhkey npm package contained malware designed to steal cryptocurrency wallets from infected systems. All versions of the package were compromised and any computer running it should be considered fully compromised. Immediate secret and key rotation from a clean system is required, and complete removal of all malicious software cannot be guaranteed by simply uninstalling the package.
Technical details
This is a supply-chain attack involving a malicious npm package (CWE-506: Embedded Malicious Code). All versions of dhkey from 0.0.0 onwards contained cryptocurrency wallet exfiltration malware. The attack is delivered via package installation from the npm registry with no authentication or user interaction required beyond installing the package. An attacker gains full system compromise and the ability to exfiltrate cryptographic material, allowing theft of cryptocurrency and other sensitive keys. No patch is available; the entire package must be considered malicious and should never be installed.
Affected products
- npm dhkey all versions from 0.0.0
Timeline
- 2020-09-03: disclosed