Executive brief
The ecuvre npm package contained malware designed to steal cryptocurrency wallets and private keys from infected systems. Any computer with this package installed should be treated as fully compromised, with all secrets and credentials needing immediate rotation from a different machine.
Technical details
This vulnerability is classified as CWE-506 (embedded malicious code). All versions of the ecuvre npm package contained intentional malware that exfiltrates cryptocurrency wallet files and private keys. The attack vector is network-based and requires no authentication or user interaction beyond installing the package; the malicious payload executes automatically during installation or module initialization. An attacker gains persistent access to the infected system with full control over stored secrets and credentials. No patch exists for this package; the only remediation is complete removal and credential rotation from a secure system.
Affected products
- npm ecuvre all versions
Timeline
- 2020-09-03: disclosed