Malicious Package in bitcoimd-rpc
Summary
GHSA-rwmv-c7v8-v9vf: Malicious Package in bitcoimd-rpc. Affects bitcoimd-rpc versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bitcoimd-rpc package is an npm package used for interacting with the Bitcoin network. It provides functionality for managing Bitcoin wallets, transactions, and other related operations. The package is widely used in various applications and projects that involve Bitcoin integration. However, all versions of this package were found to contain malware that is designed to find and exfiltrate cryptocurrency wallets.
Vulnerability Detail
The vulnerability in the bitcoimd-rpc package stems from the presence of malicious software within the package. This malware is capable of compromising the security of any computer that has the package installed or running. It is specifically designed to search for and steal cryptocurrency wallets, potentially leading to significant financial losses for affected users. Removing the package may not guarantee the complete removal of all malicious software, as the compromised computer may have given outside entities full control. Therefore, immediate action is recommended to rotate all secrets and keys stored on the affected computer from a different, secure computer.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of malware in the bitcoimd-rpc package poses a significant threat to the security of cryptocurrency wallets and the funds stored within them. Users who have this package installed or running should assume that their computer is fully compromised and take immediate action to rotate their secrets and keys from a different, secure computer. Removing the package is essential, but additional steps may be necessary to ensure the complete removal of all malicious software. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bitcoimd-rpc →
FAQ
The impact of this vulnerability can be severe, as it allows malicious actors to gain access to cryptocurrency wallets and potentially steal funds. Users who have the bitcoimd-rpc package installed or running should assume that their computer is fully compromised and take immediate action to secure their assets.
No, removing the bitcoimd-rpc package does not guarantee the complete removal of all malicious software. The compromised computer may have given outside entities full control, and additional steps, such as conducting a thorough security audit, are necessary to identify and remove any remaining malicious software.
To rotate secrets and keys stored on the compromised computer, it is recommended to perform the rotation from a different, secure computer. This ensures that the new secrets and keys are generated and stored in a trusted environment.
No, all versions of the bitcoimd-rpc package were found to contain the malicious software. It is crucial to remove the package and take appropriate security measures to protect against potential compromises.
If you suspect that your computer is compromised due to the presence of the bitcoimd-rpc package, it is recommended to disconnect it from the network immediately. Then, follow the steps outlined in the 'how_to_fix' section to secure your assets and remove the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for bitcoimd-rpc.
