Executive brief
The riped160 npm package, used by developers for cryptographic operations, contained malware designed to steal cryptocurrency wallets and other sensitive credentials from infected systems. Any computer with this package installed should be considered fully compromised, requiring immediate rotation of all secrets and keys from a clean system and complete removal of the malicious software.
Technical details
This is a supply-chain attack where all versions of the riped160 npm package contained embedded malware (CWE-506: Embedded Malicious Code). The malware was designed to locate and exfiltrate cryptocurrency wallets and cryptographic keys from the host system. The attack vector is network-based and requires no authentication—installation via npm package manager triggers automatic execution of malicious code. An attacker gains full system compromise and access to stored secrets. No patch exists; the package must be completely removed and the system should be considered permanently compromised until fully rebuilt.
Affected products
- npm riped160 all versions
Timeline
- 2020-09-03: disclosed: Malicious package disclosed in GitHub Advisory Database