Executive brief
The npm package hw-trnasport-u2f is a malicious library that steals cryptocurrency wallets and private keys from infected systems. Any developer or system that installed this package should be considered fully compromised, and all cryptographic credentials stored on that computer must be rotated immediately from a clean system. Complete system remediation is required as the attacker may have gained full control of the affected machine.
Technical details
This is a supply-chain attack exploiting typosquatting in npm (likely mimicking a legitimate Ledger hardware wallet transport library). All versions of hw-trnasport-u2f contained malicious code (CWE-506: Embedded Malicious Code) designed to discover and exfiltrate cryptocurrency wallet files and private keys. The attack vector is installation from the npm repository—a developer or automated build process that added this package as a dependency would execute the malware immediately upon installation or build. No user interaction or authentication is required; the payload executes with the privileges of the installing user or process. An attacker gains access to all cryptocurrency assets, private keys, and potentially lateral movement capabilities within the compromised environment. No patch is available; complete removal and system remediation are required.
Affected products
- npm hw-trnasport-u2f all
Timeline
- 2020-09-03: disclosed
- other: GitHub security database reviewed 2020-08-31