TL;DR: Copay event-stream flatmap-stream targeted Bitcoin theft
- The polite hijack: The scariest supply chain hijack is the polite one. A volunteer maintainer took over event-stream, published a helpful update, and everyone said thanks while flatmap-stream waited for Copay's exact build to appear.
- Targeted at Copay: The malicious flatmap-stream payload only activated in Copay's environment and reached for Bitcoin and Bitcoin Cash private keys on wallets holding substantial balances. cside deobfuscates and analyzes the full script code before it renders in the user's browser.
- Treat new deps as suspect: If you install a JavaScript dependency you did not personally review, treat any obfuscated new sub-dependency as suspicious today. If you cannot review every transitive package, monitor what your bundled JS actually does at runtime instead.
Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.
In November 2018, the JavaScript ecosystem was rattled by a sophisticated attack on Copay, a popular cryptocurrency wallet provider. Known as the event-stream attack, this incident exposed the risks of relying on third-party dependencies in software development.
Copay is now known as Bitpay Wallet.
Understanding the attack
Event-stream, a popular npm package, was widely used by many projects to manage streams of data within Node.js applications. It was a key tool for developers handling complex data flows in real-time applications.
In this article, we covered the most common hidden attack vectors and supply chain attacks in more detail.
Originally maintained by a trusted developer, the module had become a staple in many software projects due to its reliability and performance.
As often happens in open-source projects, the original maintainer of event-stream could no longer find time to manage it. In late 2018, responsibility for event-stream passed to a new volunteer maintainer. This transition, common in open-source ecosystems, did not come with rigorous security checks. The new maintainer, seemingly a well-intentioned contributor, later turned out to have malicious motives.
Shortly after taking over, this person released several updates to event-stream. Embedded within these updates was a new dependency called 'flatmap-stream'. This package was created specifically to accompany the event-stream update. Unknown to users, 'flatmap-stream' contained obfuscated malicious code, a technique used to hide its real functionality and avoid detection by security tools and code reviews.
cside deobfuscates the code so you get a full, detailed view of what's loading, then analyzes it before it renders in your user's browser. This would likely have caught this incident.
The malicious code within 'flatmap-stream' was designed to activate only under certain conditions, specifically within Copay's environment, a cryptocurrency wallet application built using JavaScript. This specificity shows the targeted nature of the attack: the attackers had a clear understanding of Copay's internal architecture and dependencies.
The payload was programmed to detect whether the environment had characteristics of Copay's development setup. Once confirmed, it would execute routines that searched for and extracted private keys and wallet details from accounts holding substantial amounts of Bitcoin and Bitcoin Cash. These details were then transmitted to a remote server controlled by the attackers.
Consequences of the attack
The event-stream incident is a textbook example of a client-side supply chain attack, where the compromise of a single component can affect thousands of downstream projects.
The stealthy insertion and activation of the malicious code meant it went undetected for several weeks. This is another common feature of supply chain attacks.
During this time, any updates to the Copay application included the compromised module, which put all active and new wallet installations at risk. Users had no idea that their newly installed or updated Copay wallets were compromised.
This attack caused financial losses for those users and dealt a severe blow to trust in open-source modules and the broader npm ecosystem.
It highlighted several important lessons:
- Trust and Verification: The need to vet the credentials and trustworthiness of anyone given control over widely used open-source projects.
- Visibility and Monitoring: The importance of having visibility into the behavior of third-party dependencies, especially those capable of compromising the integrity of critical software. cside covers all of this.
- Rapid Response: The need for fast response mechanisms when a vulnerability is discovered, to prevent widespread damage.
Immediate actions and community response
Once the malicious injection was uncovered, the npm team acted swiftly to remove the compromised version of event-stream from the registry to prevent further propagation. This version was also deprecated to ensure developers were aware of the security risk and discouraged from using it in any new projects.
The event-stream incident has had lasting implications for the npm ecosystem. It reinforced the importance of security in software development and highlighted the inherent risks of dependency chains, especially in open-source projects. It led to heightened awareness and a more cautious approach to integrating third-party packages, contributing to a more secure open-source software environment.
Read here why supply chain risk doesn't end at npm.
Prevent a similar attack with cside
The event-stream incident is a reminder of the vulnerabilities inherent in software dependencies. Such vulnerabilities expose businesses to severe risks, including data theft and financial loss. At cside we monitor, secure and even optimize your 3rd-party scripts. We offer:
- Advanced Monitoring: Our monitoring systems watch all third-party scripts and dependencies integrated into your projects. We identify unusual activity or modifications and alert you in real time, preventing potential breaches before they occur.
- Automated Security Enhancements: We automate the security of your software supply chain on the 3rd-party asset side. Before a script is delivered to a user on your site, cside checks the full code for anything malicious. If we find something, it never reaches their browser.
- Optimized For Speed: cside doesn't add latency; in most cases, it speeds up those scripts and reduces loading times.
- Proactive Defense: Our proactive approach goes beyond simple monitoring. We analyze trends in global cybersecurity threats to continually improve our defense mechanisms, which lets us anticipate and mitigate potential new attack vectors.
- Ease of Integration: Integrating cside into your existing systems is simple. Add our script as the first one to load, and all others are covered.
