Malicious code in btc-api-node (npm)
Summary
MAL-2023-1550: Malicious code in btc-api-node (npm). Affects btc-api-node versions 1.12.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The btc-api-node package is an npm package used for interacting with the Bitcoin blockchain. It provides various functionalities for querying blockchain data and performing transactions. However, this package has been found to contain malicious code.
Vulnerability Detail
The btc-api-node package has been compromised by the Lazarus Group, a hacking group known for targeting blockchain and cryptocurrency companies. They have exploited software supply chains by injecting malicious code into npm packages. This specific vulnerability allows the attackers to execute arbitrary code on systems that use the compromised package. The malicious code can potentially lead to unauthorized access, data theft, and other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall btc-api-nodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to a secure version as soon as possible.
Conclusion
The btc-api-node package has been compromised by the Lazarus Group, posing a significant security risk to systems that use this package. It is essential to update to a non-compromised version and take necessary precautions to ensure the integrity of npm packages. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for btc-api-node →
FAQ
btc-api-node is an npm package used for interacting with the Bitcoin blockchain. It provides functionalities for querying blockchain data and performing transactions.
The btc-api-node package was compromised by the Lazarus Group, a hacking group known for targeting blockchain and cryptocurrency companies. They injected malicious code into the package through the software supply chain.
The potential consequences of this vulnerability include unauthorized access, data theft, and other malicious activities. The attackers can execute arbitrary code on systems that use the compromised package.
To fix this vulnerability, it is recommended to immediately update the btc-api-node package to a non-compromised version. Verify the integrity of your npm packages and consider using package-lock.json to ensure the packages are not tampered with.
There is no known workaround for this vulnerability. It is crucial to update the package to a secure version as soon as possible.
