Executive brief
path-to-regxep is a Node.js library package that was intentionally malicious from the start. The package contained code designed to steal cryptocurrency wallets and other sensitive credentials from infected systems. Any computer with this package installed should be considered fully compromised, and all credentials stored on that system must be rotated immediately from a different, uninfected device.
Technical details
This vulnerability is classified as malicious code (CWE-506). All versions of the path-to-regxep npm package contained intentional malware designed to locate and exfiltrate cryptocurrency wallets and other secrets from the host system. The attack vector is network-based: infection occurs when a developer or system installs the package via npm. No authentication or user interaction (beyond the installation step) is required. Once installed, the malware gains arbitrary code execution in the context of the Node.js process and can access files and environment variables on the system. Complete system compromise should be assumed. Removal of the package does not guarantee removal of all malicious artifacts, as the attacker may have gained full system access during execution.
Affected products
- npm path-to-regxep all versions
Timeline
- 2020-09-03: disclosed