NPM vulnerability in Copay Wallet

Bitcoin wallet provider Bitpay has released an alert on their blog https://blog.bitpay.com/npm-package-vulnerability-copay/ on a potential vulnerability that might impact many customers.

The blog states "We have learned from a Copay GitHub issue report that a third-party NodeJS package used by the Copay and BitPay apps had been modified to load malicious code which could be used to capture users' private keys. Currently we have only confirmed that the malicious code was deployed on versions 5.0.2 through 5.1.0 of our Copay and BitPay apps. However, the BitPay app was not vulnerable to the malicious code. We are still investigating whether this code vulnerability was ever exploited against Copay users."

Their wallet users are advised to take immediate action in order to avoid any potential loss.