Executive brief
The npm package 'baes-x' has been identified as a malicious library designed to steal cryptocurrency wallets from infected systems. Any computer where this package was installed should be considered fully compromised, potentially allowing attackers to access sensitive financial assets and private keys. Organizations should immediately remove the package and rotate all credentials stored on affected machines.
Technical details
The 'baes-x' package is a malicious library distributed via the npm registry (CWE-506). All versions of the package contain code designed to locate and exfiltrate cryptocurrency wallet files from the local file system to a remote server controlled by the attacker. The attack is triggered upon installation or execution of the package, requiring no specific authentication or complex interaction. Because the package may establish persistent access or execute additional payloads, simple removal of the library is insufficient; a full system audit and rotation of all secrets (SSH keys, API tokens, etc.) is required.
Affected products
- npm baes-x All versions
Timeline
- 2020-09-04: advisory: Original advisory published by GitHub/NPM