<p>Only Copay is affected by this vulnerability.</p>

<p>Although the package was included by many, many projects (both within and outside the crypto space), the attack payload was encrypted, and used the package description as a decryption key. They key in question was found to be (<a href="https://github.com/dominictarr/event-stream/issues/116#issuecomment-441744514" rel="noreferrer">via brute force</a>) <code>A Secure Bitcoin Wallet</code>, which is the npm description for the copay-dash package.</p>

<p>Thus, packages which did not have that as their description would be unable to decrypt, and hence execute, the payload.</p>

<p>Note that such attacks are feasible on any package that does not verify and pin its dependencies, even outside the nodejs ecosystem. Developers should work to ensure that they are importing vetted code, and pin (or even vendor) their dependencies. This is especially important for programs that deal with private keys.</p>

CC BY-SA 4.0
2018-11-27T15:42:42.863Z
Can you define the verb "vendor"?  I could only find the noun in major dictionaries.
Kevin
CC BY-SA 4.0
2018-11-27T16:09:42.220Z
@Kevin Vendoring means to keep a copy of a specific version of an external code dependency within your repository, so that you are always sure of what code you are running. It also prevents a third party from changing code without changing the version number and slipping it into your application.
Raghav Sood
CC BY-SA 4.0
2018-11-27T16:15:56.037Z
Ah.  We do that all the time.  It also makes it easier to fork the dependency and/or submit pull requests (which can be a double-edged sword if you don't have enough people or expertise to support a fork, but at least it gives you options).
Kevin
CC BY-SA 4.0
2018-11-27T18:17:30.420Z
I picked vendoring based on what we call it in golang, I'm not 100% certain if the js folks have a specific term for it.
Raghav Sood
CC BY-SA 4.0
2018-11-27T11:26:38.250Z
2018-11-27T11:26:38.250Z
Raghav Sood
<p>Recently, <a href="https://github.com/dominictarr/event-stream" rel="noreferrer">a vulnerability was found in an open-source project</a> used by some bitcoin wallet software (<a href="https://blog.bitpay.com/npm-package-vulnerability-copay/" rel="noreferrer">such as CoPay and BitPay</a>). </p>

<p>Are there any other wallets known to be affected by this vulnerability? </p>

<p>If I am a user of this software, what steps can I take to secure my bitcoin?</p>

<copay><bitpay><weaknesses>
What wallets are affected by the NPM package vulnerability?
chytrik
# What wallets are affected by the NPM package vulnerability?

(Asked by: username_0 on 2018-11-27)

Recently, [a vulnerability was found in an open-source project](https://github.com/dominictarr/event-stream) used by some bitcoin wallet software ([such as CoPay and BitPay](https://blog.bitpay.com/npm-package-vulnerability-copay/)).

Are there any other wallets known to be affected by this vulnerability?

If I am a user of this software, what steps can I take to secure my bitcoin?

**Tags:** copay, bitpay, weaknesses


---

## 1 answers

### Answer by username_1 on 2018-11-27. Score: 7 | Accepted answer

Only Copay is affected by this vulnerability.

Although the package was included by many, many projects (both within and outside the crypto space), the attack payload was encrypted, and used the package description as a decryption key. They key in question was found to be ([via brute force](https://github.com/dominictarr/event-stream/issues/116#issuecomment-441744514)) `A Secure Bitcoin Wallet`, which is the npm description for the copay-dash package.

Thus, packages which did not have that as their description would be unable to decrypt, and hence execute, the payload.

Note that such attacks are feasible on any package that does not verify and pin its dependencies, even outside the nodejs ecosystem. Developers should work to ensure that they are importing vetted code, and pin (or even vendor) their dependencies. This is especially important for programs that deal with private keys.

> **Comments:**
> **username_2**: Can you define the verb "vendor"?  I could only find the noun in major dictionaries.  
> **username_1**: @username_2 Vendoring means to keep a copy of a specific version of an external code dependency within your repository, so that you are always sure of what code you are running. It also prevents a third party from changing code without changing the version number and slipping it into your application.  
> **username_2**: Ah.  We do that all the time.  It also makes it easier to fork the dependency and/or submit pull requests (which can be a double-edged sword if you don't have enough people or expertise to support a fork, but at least it gives you options).  
> **username_1**: I picked vendoring based on what we call it in golang, I'm not 100% certain if the js folks have a specific term for it.  

---

