Executive brief
The scrytsy npm package, used by developers in Node.js projects, contained malware across all versions that was designed to steal cryptocurrency wallet credentials and private keys from infected systems. Installation of this package grants attackers full control over the compromised computer, putting all stored secrets and cryptographic material at severe risk of theft.
Technical details
This is a malicious package vulnerability (CWE-506: Embedded Malicious Code) in the scrytsy npm library. All versions from 0.0.0 onward contained intentional malware. The attack vector is network-based: the malware was deployed via the public npm registry and installed when developers ran package managers (npm install). No authentication or user interaction is required beyond the installation command. The malware is designed to locate and exfiltrate cryptocurrency wallet files and private keys. Given the nature of supply-chain compromise, complete system compromise should be assumed, and all cryptographic credentials on affected machines must be rotated from a clean system.
Affected products
- npm scrytsy all versions
Timeline
- 2020-09-03: disclosed