Executive brief
The ecruve npm package contained malware designed to steal cryptocurrency wallets and other sensitive credentials from infected systems. Any system with this package installed should be considered fully compromised, as the malware may have provided attackers complete control over the machine. All cryptographic keys, secrets, and credentials stored on affected systems must be rotated immediately from a clean computer, and complete system remediation or replacement is recommended.
Technical details
This vulnerability represents a supply-chain attack via a malicious npm package (CWE-506: Embedded Malicious Code). All versions of ecruve contained malware payload designed to locate, exfiltrate, and transmit cryptocurrency wallets and private keys to attacker-controlled infrastructure. The attack vector is network-based through the npm package repository; compromise occurs upon package installation and execution. Once installed, the malware may establish persistent backdoor access, making simple package removal insufficient for full remediation. No patch exists because the entire package is malicious; the only mitigation is complete removal and system re-imaging.
Affected products
- npm ecruve all versions
Timeline
- 2020-09-03: disclosed