Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

signqle Package Contains Malware to Steal Cryptocurrency Wallets

published 6 years ago
Summary

The signqle package contains malware that can steal cryptocurrency wallets from any computer it's installed on. If you have this package installed, you should consider your computer fully compromised and immediately rotate any sensitive information from another computer. Remove the package, but be aware that it may not be enough to completely remove the malware.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
npm – signqle >= 0.0.0
Original advisory text
Malicious Package in signqle
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-506Embedded Malicious Code
Timeline
Published3 Sep 2020
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-m794-qv59-gj7c · GHSA
Track software like this
Free during beta