Executive brief
The cxct npm package, used as a software library or dependency in development projects, contains malicious code that searches for and steals cryptocurrency wallets from infected systems. Installation of this package gives attackers full control of the affected computer, enabling theft of all cryptographic keys and secrets. Affected systems should be considered fully compromised and require immediate remediation on a clean device.
Technical details
This is a supply-chain attack via a malicious npm package (CWE-506: Embedded Malicious Code). All versions of cxct contain intentionally injected malicious code designed to exfiltrate cryptocurrency wallets and keys from the host system. The package is network-accessible via the npm registry, requiring only that a developer or build system pull it as a dependency—no special authentication or user interaction is required to trigger the malicious payload. Once executed, the attacker gains full code execution on the infected system, enabling comprehensive data theft and system compromise. There is no patch available; the package must be completely removed and the system rebuilt from a trusted state.
Affected products
- npm cxct all versions
Timeline
- 2020-09-04: disclosed: Malicious package publicly identified on npm registry