Malicious Package in coinstrig
Summary
GHSA-4m3j-h8f2-4xh4: Malicious Package in coinstrig. Affects coinstrig versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
coinstrig is an npm package that is used for cryptocurrency-related operations. It provides functionality for managing cryptocurrency wallets and transactions. Unfortunately, all versions of this package contained malware that was specifically designed to find and exfiltrate cryptocurrency wallets.
Vulnerability Detail
The malicious package in coinstrig poses a significant security risk to any computer that has it installed or running. The package is designed to steal cryptocurrency wallets and can give full control of the compromised computer to an outside entity. As a result, all secrets and keys stored on the affected computer should be rotated immediately from a different computer. Removing the package may not guarantee the removal of all malicious software resulting from its installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The presence of the malicious package in coinstrig poses a critical security risk to any computer that has it installed or running. It is crucial to take immediate action by rotating all secrets and keys stored on the affected computer and removing the package. Additionally, conducting a thorough security audit is essential to identify any other potential compromises or vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for coinstrig →
FAQ
coinstrig is an npm package used for cryptocurrency-related operations, such as managing cryptocurrency wallets and transactions.
The malicious package in coinstrig is designed to steal cryptocurrency wallets, compromising the security of the affected computer and potentially giving control to an outside entity.
To protect your computer, it is recommended to remove the coinstrig package and rotate all secrets and keys stored on the affected computer from a different, secure computer.
Yes, all versions of coinstrig are affected by this vulnerability as they contain the malicious package.
No, there is no guarantee that removing the package will remove all malicious software resulting from its installation. A thorough security audit is recommended to identify any other potential compromises or vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for coinstrig.
