GitHub Advisoryadvisory · npm

GHSA-j8qr-rvcv-crhv Malicious Package in electron-native-notify

CRITICAL Published 2020-09-11 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
electron-native-notify
Severity
Critical
Reviewed
2020-08-31

Affected packages

• npm electron-native-notify: all versions (no fix yet)

Description

All versions of `electron-native-notify` contain malicious code. The package was part of a targeted attack to steal cryptocurrency wallet seeds and upload them to a remote server, effectively giving attackers access to users wallets. Recommendation Remove the package from your environment and follow the recommendations by Komodo

References