NodeJS Library Event-Stream version 3.3.6 containing a new library, called Flatmap-Stream, as a dependency, which was specifically crafted and designed to target people using BitPay's open-source bitcoin wallet app, Copay, a company that incorporated event-stream into its app.
Interestingly Since the flatmap-stream module was encrypted, the malicious code remained undetected for more than 2 months until Ayrton Sparling (FallingSnow), a computer science student at California State University, flagged the issue Tuesday on GitHub.
Interestingly Since the flatmap-stream module was encrypted, the malicious code remained undetected for more than 2 months until Ayrton Sparling (FallingSnow), a computer science student at California State University, flagged the issue Tuesday on GitHub.
As a preventive action open source project manager that hosted event-stream code library—removed the backdoor from NPM's listing .
BitPay also published an advisory saying Copay versions 5.0.2 through 5.1.0 were affected by the malicious code and that users with these versions installed should avoid running or opening the app until they install Copay version 5.2.0.
BitPay also published an advisory saying Copay versions 5.0.2 through 5.1.0 were affected by the malicious code and that users with these versions installed should avoid running or opening the app until they install Copay version 5.2.0.
"Users should assume that private keys on affected wallets may have been compromised, so they should move funds to new wallets (v5.2.0) immediately," BitPay says in the advisory.
"Users should first update their affected wallets (5.0.2-5.1.0) and then send all funds from affected wallets to a brand new wallet on version 5.2.0, using the Send Max feature to initiate transactions of all funds."
"Users should first update their affected wallets (5.0.2-5.1.0) and then send all funds from affected wallets to a brand new wallet on version 5.2.0, using the Send Max feature to initiate transactions of all funds."
