A hacker has gained (legitimate) access to a popular JavaScript library and has injected malicious code that steals Bitcoin and Bitcoin Cash funds stored inside BitPay's Copay wallet apps.

Rogue dev takes over They found that earlier versions of the library that are still in use include a new component, 'flatmap-stream' version 0.1.1, that contains dangerous code.

React, also known as ReactJS, is an open source JavaScript library for building user interfaces, often for single-page applications or to add interactive views to existing web applications built ...

The library, which was listed in NPM’s repository, was then updated with malicious code that contains cryptocurrency-stealing malware. Put another way, Event-Stream was updated to include ...

A recently revised JavaScript library now makes it possible to run untrusted JavaScript code, in either Node.js or a modern browser, via a sandboxed environment that provides a controlled way to ...