Executive brief
A seemingly legitimate Node.js package (electron-native-notify) was compromised to steal cryptocurrency wallet seed phrases from users of the Komodo Agama wallet. After gaining user trust over several months, attackers injected malicious code that exfiltrated wallet secrets to a remote server, enabling unauthorized access to over $13 million in cryptocurrency assets. Users who installed the compromised package versions had their wallet credentials stolen and accounts drained.
Technical details
This is a malicious package attack targeting a Node.js library used as a transitive dependency in the Komodo Agama cryptocurrency wallet. An attacker (sawlysawly on GitHub) made legitimate contributions to gain trust, then published a clean version of electron-native-notify (1.1.5) which was adopted by Agama wallet developers. Subsequent versions (1.1.6 onwards) contained malicious JavaScript code that harvested wallet seed phrases at runtime and exfiltrated them to a remote server (updatecheck.herokuapp.com). The attack required no user interaction beyond running the wallet application; code execution occurred automatically during application initialization. Komodo responded by moving approximately 8 million KMD and 96 BTC from compromised wallets using the leaked seed phrases. The malicious code has been removed from npm and all versions are considered compromised.
Affected products
- npm electron-native-notify all versions, with malicious payload introduced in version 1.1.6 (2019-03-23)
Timeline
- 2019-06-04: disclosed: npm security team notified Komodo of vulnerability
- 2019-06-05: disclosed: npm published security advisory detailing the malware attack
- 2019-06-05: patched: Malicious package removed from npm registry
- 2020-09-11: advisory: GHSA-j8qr-rvcv-crhv published in GitHub Advisory Database