Executive brief
The npm package 'we3b' has been identified as a malicious library designed to steal cryptocurrency wallets from infected systems. If this package is installed, an attacker could gain access to digital assets and sensitive keys stored on the machine. Organizations should consider any system that ran this package as fully compromised and rotate all credentials immediately.
Technical details
The 'we3b' package is a malicious library (CWE-506) distributed via the npm registry. All versions of the package contain code designed to scan the local file system for cryptocurrency wallet files and exfiltrate them to a remote server controlled by the attacker. The attack is executed automatically upon installation or execution of the package without requiring user interaction or specific privileges. Because the package may establish persistent access or execute additional payloads, simple removal of the package is insufficient; a full system audit and credential rotation are required.
Affected products
- npm we3b All versions
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-03: disclosed: Advisory published