Executive brief
flatmap-stream is a Node.js library used in application builds. Version 0.1.1 contained malicious code designed to steal cryptocurrency wallet credentials and private keys from users of the Copay Bitcoin wallet application. If installed as a build dependency, it would inject obfuscated theft code into the final application bundle, compromising the wallets of end users who downloaded the infected application.
Technical details
This vulnerability involves supply-chain injection of encrypted malicious payloads hidden in a test fixture file. The injected code decrypts AES-encrypted data using the package description as the key, compiles and executes the decrypted module in memory, then further decrypts and processes additional payload chunks before writing obfuscated JavaScript to a build dependency. The attack specifically targets applications importing flatmap-stream as a build-time dependency. No user authentication or interaction is required—the malicious code executes automatically during the package installation and build process. The attack was designed to detect Copay-related environments and steal Bitcoin/Bitcoin Cash balances exceeding 100 BTC or 1000 BCH, along with associated account credentials and private keys. The malicious version has been removed from the npm Registry.
Affected products
- npm flatmap-stream 0.1.1
Timeline
- 2020-09-01: disclosed