Executive brief
The 'bcion' package on the npm registry was found to contain malicious code across all versions. This package was specifically designed to locate and steal cryptocurrency wallet files from any system where it was installed. Organizations using this package should consider their systems fully compromised, as attackers may have gained unauthorized access to sensitive financial keys and credentials.
Technical details
The 'bcion' package is a malicious library distributed via the npm registry (CWE-506). All versions of the package contain malware that automatically scans the host system for cryptocurrency wallet files and exfiltrates them to a remote server. The attack vector is remote and requires no authentication or specific user interaction beyond the installation of the package. Because the package may have established persistent access or executed additional payloads, security teams are advised to rotate all secrets and perform a full system rebuild rather than simply removing the package.
Affected products
- npm bcion All versions
Timeline
- 2020-08-31: disclosed: GitHub reviewed the advisory
- 2020-09-04: advisory: Advisory published