HomeTECHNICALNPM Attack: Javascript Library Compromise Goes After Bitcoin Wallets

NPM Attack: Javascript Library Compromise Goes After Bitcoin Wallets

NPM developer qix's account compromise potentially puts user funds at risk by compromising library dependencies used by bitcoin wallets.

A major NPM developer, qix, has had their account compromised. It was used to push malware that targets and searches for bitcoin and cryptocurrency wallets on users devices. If detected, the malware would patch the code functions used to coordinate transaction signing, and replace the address a user is trying to send money to with one of the malware creator’s own addresses.

This should mostly be a concern for web wallet users, so in the Bitcoin ecosystem Ordinals or Runes/other token users, as unless an update for your normal software wallet happened to be pushed just earlier today with the compromised dependency, or if your wallet dynamically loads code directly from the wallet back end bypassing the app-store, you should be fine.

NPM is a package manager for Node.js, a popular Javascript framework. This means it is used to grab large sets of pre-written code used for common functionality to be integrated into different programs without the developer having to rewrite basic functions themselves.

The targeted packages were not cryptocurrency specific, but packages used by countless numbers of normal applications built with Node.js, not just cryptocurrency wallets.

If you are using a hardware wallet in combination with your web wallet, take extra care to verify on the device itself that the destination address you are sending too is correct before signing anything.

If you are using software keys in the web wallet itself, it would be advisable to not open them or transact until you are certain you are not running a vulnerable version of the wallet. The safest course of action would be waiting for an announcement from the team developing the wallet you use.

Shinobi
Shinobi
Shinobi is an pseudonymous self taught educator in the Bitcoin space. He was the co-host of Block Digest, a news/tech oriented Bitcoin podcast, as well as What Bitcoin Did Tech Show with Peter McCormack which centered around explaining technical concepts to non-technical users. That is all he will tell us about himself.
Bitcoin Bitcoin BTC/USD
$0.00
24hr %:
0.0%
24hr High:
$0.00
24hr Low:
$0.00
Error loading data. Check console for details.
VIEW 150+ BITCOIN CHARTS