Executive brief
The signqle npm package contained malware designed to steal cryptocurrency wallets from infected systems. Any computer with this package installed should be considered fully compromised, and all cryptographic credentials stored on that computer must be regenerated from a secure, unaffected device.
Technical details
All versions of the signqle npm package contained intentionally malicious code (CWE-506) designed to locate and exfiltrate cryptocurrency wallets. The attack requires installation of the package, either directly or as a transitive dependency. Once installed, the malware gains execution within the Node.js runtime with the privileges of the installing user, allowing full access to the user's home directory and stored secrets. There is no patch available for this package; it must be completely removed and replaced with alternative, legitimate libraries.
Affected products
- npm signqle all versions
Timeline
- 2020-09-03: disclosed