PT-2020-21366 · Unknown · Electron-Native-Notify

Published 2020-09-11 · Updated 2020-09-11

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions electron-native-notify versions (affected versions not specified)

Description The issue concerns malicious code in the electron-native-notify package, which was used in a targeted attack to steal cryptocurrency wallet seeds. This allowed attackers to upload the seeds to a remote server, giving them access to users' wallets.

Recommendations Remove the electron-native-notify package from your environment.

Related Identifiers

GHSA-J8QR-RVCV-CRHV

Affected Products

Electron-Native-Notify

References · 4

• https://osv.dev/vulnerability/GHSA-j8qr-rvcv-crhv · Vendor Advisory
• https://blog.npmjs.org/post/185397814280/plot-to-steal-cryptocurrency-foiled-by-the-npm · Note
• https://komodoplatform.com/vulnerability-discovered-in-komodos-agama-wallet-this-is-what-you-need-to-do · Note
• https://npmjs.com/advisories/927 · Note