Malicious Package in bpi39 - Cryptocurrency Wallet Exfiltration
Summary
GHSA-762c-v946-pf25: Malicious Package in bpi39. Affects bpi39 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bpi39 package is an npm package that is used in various applications. It provides functionality related to a specific domain. However, all versions of this package were found to contain malware. The package was specifically designed to find and exfiltrate cryptocurrency wallets. This means that if the package is installed or running on a computer, the computer should be considered fully compromised. Any secrets and keys stored on that computer should be rotated immediately from a different computer. It is important to note that removing the package may not remove all the malicious software that may have been installed as a result of its installation.
Vulnerability Detail
The vulnerability in the bpi39 package is due to the presence of malware within the package. The malware is designed to search for and steal cryptocurrency wallets. This can have severe consequences for users who have installed or are running the package, as their cryptocurrency wallets can be compromised. The package should be considered highly critical and immediate action should be taken to mitigate the risk. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The bpi39 package has been found to contain malware that is designed to find and exfiltrate cryptocurrency wallets. This vulnerability is highly critical and can result in severe financial loss for affected users. Immediate action should be taken to identify and remove the package from all affected computers. Additionally, all secrets and keys stored on these computers should be rotated from a different secure computer. A thorough security audit is necessary to ensure the complete removal of any malicious software. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bpi39 →
FAQ
The impact of this vulnerability is severe as it can result in the compromise of cryptocurrency wallets, leading to financial loss for the affected users.
If you have the bpi39 package installed or running on your computer, it should be considered compromised. It is recommended to follow the steps mentioned in the 'How to Fix' section to mitigate the risk.
While removing the bpi39 package is recommended, there is no guarantee that it will remove all the malicious software that may have been installed as a result of its installation. A thorough security audit is necessary to ensure the complete removal of any malicious software.
If you have already been affected by this vulnerability, it is crucial to rotate all secrets and keys stored on the compromised computer from a different secure computer. Additionally, perform a thorough security audit to identify and remove any other malicious software that may be present.
Recovering compromised cryptocurrency wallets can be challenging. It is recommended to contact a cybersecurity professional or seek guidance from the relevant cryptocurrency wallet provider for assistance in recovering the wallets.
References
Related vulnerabilities
Recent vulnerabilities recorded for bpi39.
