Malicious Package in scryptys - Cryptocurrency Wallet Exfiltration
Summary
GHSA-vrxj-4qhw-5vwq: Malicious Package in scryptys. Affects scryptys versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
scryptys is an npm package that is used for [provide brief description of the package functionality]. It is designed to [mention key attributes or features of the package]. However, all versions of this package have been found to contain malware that targets cryptocurrency wallets.
Vulnerability Detail
The scryptys package, in all versions, includes a malicious payload that is capable of finding and exfiltrating cryptocurrency wallets. This payload has the potential to compromise the security of any computer where the package is installed or running. Once installed, the package gives full control of the computer to an external entity. As a result, all secrets and keys stored on the compromised computer should be rotated immediately from a different computer. Although removing the package is recommended, it cannot guarantee the removal of all malicious software that may have been installed as a result of its installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to follow the recommended steps for remediation.
Conclusion
The scryptys package has been found to contain a malicious payload that compromises the security of computers where it is installed. It is crucial to take immediate action to rotate keys, remove the package, and conduct a security audit. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for scryptys →
FAQ
scryptys is an npm package used for [provide brief description of the package functionality].
The vulnerability in scryptys allows for the installation of malicious software that can find and exfiltrate cryptocurrency wallets. This compromises the security of the affected computer and requires immediate action to rotate keys and remove the package.
To fix this vulnerability, you need to rotate all secrets and keys stored on the compromised computer from a different, secure computer. Additionally, remove the scryptys package and conduct a thorough security audit.
No, there is no known workaround for this vulnerability. It is crucial to follow the recommended steps for remediation.
To ensure your computer is no longer compromised, it is essential to rotate all secrets and keys stored on the compromised computer, remove the scryptys package, and conduct a thorough security audit.
