Executive brief
The siganle npm package, used by developers in Node.js applications, was found to contain malware designed to steal cryptocurrency wallets and other sensitive credentials from infected systems. Any computer with this package installed should be considered fully compromised, and all cryptographic keys and secrets must be rotated immediately from a separate, uninfected machine. While removal of the package is recommended, complete remediation may require full system rebuilds due to the malware's potential for deep system access.
Technical details
This is a supply-chain attack vector (CWE-506: Embedded Malicious Code) in which all versions of the siganle npm package contained intentionally injected malware. The malicious payload targets cryptocurrency wallets and other sensitive credentials stored on the host system, performing data exfiltration to attacker-controlled infrastructure. Installation occurs automatically during npm package dependency resolution with no user interaction required beyond normal development workflow. The attack is network-based and requires no authentication. An attacker gains the ability to harvest cryptographic material and potentially establish persistent backdoor access to the compromised system. No patch is available; affected users must uninstall the package and assume full system compromise.
Affected products
- npm siganle all versions
Timeline
- 2020-09-03: disclosed: Malicious package published to npm registry and detected