Malicious Package in bcion - Cryptocurrency Wallet Exfiltration
Summary
GHSA-2fwq-wx47-hm6x: Malicious Package in bcion. Affects bcion versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
bcion is an npm package that is used for cryptocurrency-related operations. It provides functionalities for managing and interacting with cryptocurrency wallets. The package has been widely used by developers for various cryptocurrency applications. However, all versions of bcion were found to contain malware that is designed to find and exfiltrate cryptocurrency wallets.
Vulnerability Detail
The vulnerability in bcion arises from the presence of malicious code within the package. The malware is capable of identifying and stealing cryptocurrency wallets, which can lead to significant financial losses for users. Any computer that has this package installed or running should be considered fully compromised. It is crucial to rotate all secrets and keys stored on the affected computer immediately from a different, secure computer. Although removing the package is recommended, it may not guarantee the removal of all malicious software that may have been installed as a result of its presence.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability. It is crucial to follow the recommended steps for fixing the issue.
Conclusion
The bcion package has been found to contain malware capable of exfiltrating cryptocurrency wallets. It is essential to take immediate action to mitigate the risks associated with this vulnerability. Follow the recommended steps for fixing the issue, and conduct a thorough security audit to ensure no other malicious software is present. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bcion →
FAQ
bcion is an npm package used for cryptocurrency-related operations, such as managing and interacting with cryptocurrency wallets.
The vulnerability allows malicious actors to find and exfiltrate cryptocurrency wallets, leading to potential financial losses for users.
If you have the bcion package installed on your computer, it is considered compromised. It is recommended to follow the steps for fixing the vulnerability.
While removing the bcion package is recommended, there is no guarantee that it will remove all malicious software that may have been installed as a result of its presence. A thorough security audit is advised.
If you have been affected by this vulnerability, it is crucial to rotate all secrets and keys stored on the affected computer immediately from a different, secure computer. Follow the steps for fixing the vulnerability and conduct a security audit.
References
Related vulnerabilities
Recent vulnerabilities recorded for bcion.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
