Malicious Package in bitcroe-lib
Summary
GHSA-4m3p-x2hp-2pgx: Malicious Package in bitcroe-lib. Affects bitcroe-lib versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bitcroe-lib is an npm package that is used for cryptocurrency-related functionality. It provides various features and utilities for managing cryptocurrency wallets and transactions. However, all versions of this package were found to contain malware. The package was specifically designed to find and exfiltrate cryptocurrency wallets, posing a significant security risk to users.
Vulnerability Detail
The vulnerability in bitcroe-lib arises from the presence of malicious code within the package. When installed or running on a computer, the package compromises the system and grants control to an external entity. This allows the attacker to access and steal any cryptocurrency wallets or keys stored on the compromised computer. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. The best course of action is to follow the recommended steps for fixing the issue.
Conclusion
The presence of malware in the bitcroe-lib package poses a significant security risk to users. It is crucial to take immediate action by rotating all keys and secrets stored on compromised systems and removing the package. Thorough security measures should be implemented to ensure the system is clean and secure. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bitcroe-lib →
FAQ
bitcroe-lib is an npm package used for cryptocurrency-related functionality, providing utilities for managing cryptocurrency wallets and transactions.
The impact of this vulnerability is severe. It allows an attacker to gain control of the compromised system and exfiltrate cryptocurrency wallets and keys stored on that computer.
To protect your computer, it is essential to remove the bitcroe-lib package and rotate all secrets and keys stored on the compromised system from a secure computer.
No, there is no guarantee that removing the package will remove all malicious software resulting from its installation. Thorough security measures should be taken to ensure the system is clean and secure.
This vulnerability is rated as CRITICAL with a CVSS score of 9.1, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for bitcroe-lib.
