A major NPM developer, qix, has had their account compromised. This was done to spread malware which targets bitcoins and cryptocurrency wallets and looks for them on the users’ computers. The malware, if detected, would replace an address that a user was trying to send funds to with the creator of the malware’s.
The only users who should be concerned are those using web wallets. In the Bitcoin ecosystem, users should not be worried unless they have a software wallet that dynamically loads the code from the backend of the wallet, bypassing app stores.
NPM, or Node.js package manager is a tool for the popular Javascript framework Node.js. It is used for grabbing large amounts of code that are used in common functions to be integrated into other programs, without having the developer to rewrite them.
Not only cryptocurrency wallets but also countless other applications using Node.js were targeted.
Use a hardware wallet with your web wallet. Verify on the device that you’re sending to the correct address before you sign anything.
It is best to avoid opening or transacting with software keys that are stored in the web wallet until you can be sure you’re not using a compromised version. Waiting for an official announcement by the developers of the wallet is the safest way to proceed.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: bitcoinmagazine.com
