Executive brief
The scryptys npm package contained malware in all versions designed to locate and steal cryptocurrency wallets from infected computers. Installation of this package grants attackers full control over the system, putting all stored credentials, keys, and sensitive data at immediate risk of compromise. Removal of the package does not guarantee removal of all malicious code that may have been deployed.
Technical details
This is a malicious package attack (CWE-506) in which the scryptys npm library distributed via npm was deliberately crafted with embedded malware. The malware is designed to search for and exfiltrate cryptocurrency wallet files and keys from the infected system. The attack vector is installation via npm package manager, requiring user trust in the package name or a dependency chain that pulls in the malicious package. Once installed and executed, the malware provides attackers with full system access and ability to steal all secrets and cryptographic keys stored on the affected computer. No legitimate patch is available; the entire package must be removed and the system treated as fully compromised.
Affected products
- scryptys scryptys all versions
Timeline
- 2020-09-03: disclosed: Advisory published