Executive brief
The npm package 'coinpayment' has been identified as a malicious library designed to steal cryptocurrency wallets. If this package is installed in your environment, attackers can exfiltrate sensitive keys and digital assets, leading to total financial loss and system compromise. Any system that has run this package should be treated as fully breached, requiring a complete rotation of all secrets and a rebuild of the affected infrastructure.
Technical details
All versions of the npm package 'coinpayment' are confirmed to contain malware (CWE-506). The malicious code is designed to scan the host filesystem for cryptocurrency wallet files and exfiltrate them to a remote server controlled by the attacker. The attack is executed automatically upon installation or execution of the package, requiring no specific user interaction beyond the initial dependency inclusion. Because the package provides an attacker with potential full control over the host environment, simple removal of the package is insufficient; a full system audit and rotation of all stored credentials (API keys, SSH keys, etc.) are required.
Affected products
- npm coinpayment All versions
Timeline
- 2020-09-03: advisory: Advisory published by GitHub/NPM