Executive brief
singale is a JavaScript library available on npm that was discovered to contain malware in all versions. The malware is designed to locate and steal cryptocurrency wallets and private keys from infected systems. Any computer with this package installed should be considered completely compromised, and all secrets and cryptographic keys stored on it must be rotated immediately from a different, unaffected device.
Technical details
This vulnerability is a case of intentional malicious code injection (CWE-506) embedded directly in all versions of the singale npm package. The malware performs reconnaissance and exfiltration of cryptocurrency wallets stored on the host system. The attack vector is network-based: installation occurs when a developer or build system fetches the package from the npm registry. No authentication bypass or technical exploitation is required—the malicious code executes upon installation and import. An attacker gains full control over the compromised system, enabling data theft and lateral movement. Given the severity, comprehensive system remediation (not just package removal) is recommended, as the attacker may have installed additional persistent backdoors.
Affected products
- singale singale all
Timeline
- 2020-09-03: disclosed