Executive brief
bitcoin-osp is a JavaScript library distributed via npm that was found to contain malware in all versions. The package was deliberately designed to search for and steal cryptocurrency wallets and private keys from infected systems. Any computer with this package installed should be considered fully compromised, and all cryptographic credentials stored on that machine must be regenerated from a clean system.
Technical details
This is a malicious package vulnerability (CWE-506: Embedded Malicious Code). All versions of the bitcoin-osp npm package contained intentional malware code designed to locate and exfiltrate cryptocurrency wallet files and keys. The attack vector is network-based (installation via npm package manager) with no authentication or user interaction required beyond running the package. An attacker who successfully installs this package gains full code execution within the Node.js runtime and can access all files and secrets on the affected system. Complete removal of malware is not guaranteed even after package removal, as the attacker may have established additional persistence mechanisms.
Affected products
- npm bitcoin-osp all versions
Timeline
- 2020-09-04: disclosed: Advisory published on GitHub
- 2020-08-31: other: GitHub security team reviewed the advisory