Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Search

GHSA-9x64-5r7x-2q53

CriticalCVSS 9.8 / 10
Published Sep 1, 2020·Last modified Oct 1, 2021
Affected Components(0)

No affected components available

Description

Version 0.1.1 of flatmap-stream is considered malicious.

This module runs an encrypted payload targeting a very specific application, copay and because they shared the same description it would have likely worked for copay-dash.

The injected code:

  • Read in AES encrypted data from a file disguised as a test fixture
  • Grabbed the npm package description of the module that imported it, using an automatically set environment variable
  • Used the package description as a key to decrypt a chunk of data pulled in from the disguised file

The decrypted data was part of a module, which was then compiled in memory and executed.

This module performed the following actions:

  • Decrypted another chunk of data from the disguised file
  • Concatenated a small, commented prefix from the first decrypted chunk to the end of the second decrypted chunk
  • Performed minor decoding tasks to transform the concatenated block of code from invalid JS to valid JS (we believe this was done to evade detection by dynamic analysis tools)
  • Wrote this processed block of JS out to a file stored in a dependency that would be packaged by the build scripts:

The chunk of code that was written out was the actual malicious code, intended to be run on devices owned by the end users of Copay.

This code would do the following:

  • Detect the current environment: Mobile/Cordova/Electron
  • Check the Bitcoin and Bitcoin Cash balances on the victim's copay account
  • If the current balance was greater than 100 Bitcoin, or 1000 Bitcoin Cash:
    • Harvest the victim's account data in full
    • Harvest the victim's copay private keys
    • Send the victim's account data/private keys off to a collection

Recommendation

If you find this module in your environment it's best to remove it. The malicious version of event-stream and flatmap-stream have been removed from the npm Registry.

Risk Scores
Base Score
9.8

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data. There is a high impact on the availability of the system.

Threat Intelligence
9.0

Active exploitation in the wild has been confirmed. Immediate patching or mitigation is required.

EPSS
N/A

Probability that this vulnerability will be exploited in the wild within the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard