Malicious npm Package Alert: Crypto Wallets Under Siege by ‘pdf-to-office’ Malware!
ReversingLabs has uncovered a malicious npm package called “pdf-to-office” targeting Atomic and Exodus crypto wallet users. This sneaky malware silently swaps recipient wallet addresses, hijacking transactions while remaining undetected. Even after removal, the compromised software stays infected, prompting a complete reinstallation to eliminate the threat.
Hot Take:
Oh, the irony! A package named “pdf-to-office” that promises to turn PDFs into Office documents but instead converts your crypto wallet into a generous donation platform for cybercriminals. Who knew document conversion could be so philanthropic?
Key Points:
- ReversingLabs discovered a malicious npm package, “pdf-to-office,” targeting crypto wallets.
- The malware patches legitimate wallet software files to hijack transactions.
- Persistence of the malware remains even after the package is removed.
- Targets specifically Atomic and Exodus wallets by swapping recipient wallet addresses.
- Similar to past attacks using npm packages to inject malicious code.
Already a member? Log in here