Executive brief
The fs-extar npm package is a library used by developers to handle file operations. All versions of this package contained malware that steals cryptocurrency wallets and other sensitive credentials from infected systems. Any computer that installed this package should be considered completely compromised and all secrets, keys, and cryptocurrency wallets must be rotated immediately from a secure, unaffected machine.
Technical details
This is a supply chain attack involving a malicious npm package (CWE-506: Embedded Malicious Code). All versions of fs-extar contained malware with the capability to locate and exfiltrate cryptocurrency wallet files and other sensitive credentials. The attack requires only installation of the package via npm—no special privileges, authentication, or user interaction are required beyond the initial installation. Once installed, the malware executes with the privileges of the user running Node.js and can exfiltrate sensitive files to a remote attacker-controlled server. The vulnerability affects any developer or system that installed this package. There is no patch available; the only mitigation is complete removal and system remediation, though full malware removal cannot be guaranteed given the attacker may have obtained unrestricted access during execution.
Affected products
- npm fs-extar all versions
Timeline
- 2020-09-03: disclosed: Published as GHSA-435c-qcpm-wjw5