Malware in em-owa-walletconnect-sign-client (npm) — full compromise of installed machines; no patched version
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub published a malware advisory (GHSA-q36f-8vwc-6vxm) on 2026-11-13 for the npm package em-owa-walletconnect-sign-client, flagging it as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with attacker control of the machine and exposure of all secrets and keys stored on it. The package has low reach (~43 downloads/month) but is a wallet-connect themed package likely targeting crypto credentials. Removal of the package does not guarantee removal of resulting malicious software. No source code repository is known for the package.
What to do
- Treat any machine with the package installed as fully compromised; rotate all secrets and keys from a clean machine
- Remove the package and rebuild/reimage affected systems
- Audit dependency trees and lockfiles for the package and block it in registries/proxies
- Review logs and credentials for signs of exfiltration, especially crypto wallet keys
- Rotate npm tokens and CI credentials if the package was used in build environments
Sources
All live incidents on Threat Watch
