Executive brief
The npm package 'web3-eht' has been identified as a malicious library designed to steal cryptocurrency wallets. If installed, the package can exfiltrate sensitive keys and digital assets to an external attacker. Organizations should assume any system where this package was installed is fully compromised and immediately rotate all stored credentials and secrets.
Technical details
The 'web3-eht' package is a malicious library distributed via the npm registry (CWE-506). All versions of the package contain code that automatically searches for and exfiltrates cryptocurrency wallet files and associated private keys to a remote server controlled by the attacker. The attack is triggered upon installation or execution of the package, requiring no specific authentication or complex interaction. Because the package may establish persistent access or install additional backdoors, simple removal of the package is insufficient; affected systems should be treated as fully compromised and undergo a complete forensic wipe and credential rotation.
Affected products
- npm web3-eht All versions
Timeline
- 2020-08-31: disclosed: GitHub reviewed the advisory
- 2020-09-03: advisory: Advisory published