Executive brief
The coinstrig npm package is a malicious software component designed to steal cryptocurrency wallets from developer machines. Installation of this package grants an attacker full control over the infected computer, enabling theft of digital assets and credentials. Complete system compromise is assumed; removal of the package alone cannot guarantee removal of all malicious software deployed during the attack.
Technical details
This vulnerability is a supply chain attack implementing malware (CWE-506: embedded malicious code). The coinstrig package distributed via npm was intentionally designed to locate and exfiltrate cryptocurrency wallet files and private keys from the host system. The attack vector is network-based; infection occurs upon package installation with no authentication or user interaction required beyond the install command. All versions (from 0.0.0 onward) are affected. An attacker gaining execution in the npm install process achieves full system compromise, including potential persistent backdoors and credential theft. No patch is available; the package must be removed entirely and all affected systems treated as compromised.
Affected products
- npm coinstrig all versions
Timeline
- 2020-09-03: disclosed: Malicious package published and discovered